Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2018-0734 (GCVE-0-2018-0734)
Vulnerability from cvelistv5
Published
2018-10-30 12:00
Modified
2024-09-16 23:10
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Constant time issue
Summary
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T03:35:49.290Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html" }, { "name": "USN-3840-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/3840-1/" }, { "name": "DSA-4355", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2018/dsa-4355" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20181105-0002/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.tenable.com/security/tns-2018-17" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.tenable.com/security/tns-2018-16" }, { "name": "105758", "tags": [ "vdb-entry", "x_refsource_BID", "x_transferred" ], "url": "http://www.securityfocus.com/bid/105758" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7" }, { "name": "DSA-4348", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2018/dsa-4348" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://www.openssl.org/news/secadv/20181030.txt" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20190118-0002/" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20190423-0002/" }, { "name": "openSUSE-SU-2019:1547", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "name": "openSUSE-SU-2019:1814", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html" }, { "name": "RHSA-2019:2304", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "name": "FEDORA-2019-db06efdea1", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/" }, { "name": "FEDORA-2019-00c25b9379", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/" }, { "name": "FEDORA-2019-9a0a7c0986", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/" }, { "name": "RHSA-2019:3700", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:3700" }, { "name": "RHSA-2019:3933", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "name": "RHSA-2019:3935", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "name": "RHSA-2019:3932", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "OpenSSL", "vendor": "OpenSSL", "versions": [ { "status": "affected", "version": "Fixed in OpenSSL 1.1.1a (Affected 1.1.1)" }, { "status": "affected", "version": "Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i)" }, { "status": "affected", "version": "Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)" } ] } ], "credits": [ { "lang": "en", "value": "Samuel Weiser" } ], "datePublic": "2018-10-30T00:00:00", "descriptions": [ { "lang": "en", "value": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)." } ], "metrics": [ { "other": { "content": { "lang": "eng", "url": "https://www.openssl.org/policies/secpolicy.html#Low", "value": "Low" }, "type": "unknown" } } ], "problemTypes": [ { "descriptions": [ { "description": "Constant time issue", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-04-15T21:06:42", "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl" }, "references": [ { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html" }, { "name": "USN-3840-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/3840-1/" }, { "name": "DSA-4355", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2018/dsa-4355" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20181105-0002/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.tenable.com/security/tns-2018-17" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.tenable.com/security/tns-2018-16" }, { "name": "105758", "tags": [ "vdb-entry", "x_refsource_BID" ], "url": "http://www.securityfocus.com/bid/105758" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7" }, { "name": "DSA-4348", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2018/dsa-4348" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://www.openssl.org/news/secadv/20181030.txt" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20190118-0002/" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.netapp.com/advisory/ntap-20190423-0002/" }, { "name": "openSUSE-SU-2019:1547", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "name": "openSUSE-SU-2019:1814", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html" }, { "name": "RHSA-2019:2304", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "name": "FEDORA-2019-db06efdea1", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/" }, { "name": "FEDORA-2019-00c25b9379", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/" }, { "name": "FEDORA-2019-9a0a7c0986", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/" }, { "name": "RHSA-2019:3700", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:3700" }, { "name": "RHSA-2019:3933", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "name": "RHSA-2019:3935", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "name": "RHSA-2019:3932", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" } ], "title": "Timing attack against DSA", "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "openssl-security@openssl.org", "DATE_PUBLIC": "2018-10-30", "ID": "CVE-2018-0734", "STATE": "PUBLIC", "TITLE": "Timing attack against DSA" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "OpenSSL", "version": { "version_data": [ { "version_value": "Fixed in OpenSSL 1.1.1a (Affected 1.1.1)" }, { "version_value": "Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i)" }, { "version_value": "Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)" } ] } } ] }, "vendor_name": "OpenSSL" } ] } }, "credit": [ { "lang": "eng", "value": "Samuel Weiser" } ], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)." } ] }, "impact": [ { "lang": "eng", "url": "https://www.openssl.org/policies/secpolicy.html#Low", "value": "Low" } ], "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Constant time issue" } ] } ] }, "references": { "reference_data": [ { "name": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html", "refsource": "CONFIRM", "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html" }, { "name": "USN-3840-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3840-1/" }, { "name": "DSA-4355", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2018/dsa-4355" }, { "name": "https://security.netapp.com/advisory/ntap-20181105-0002/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20181105-0002/" }, { "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f", "refsource": "CONFIRM", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f" }, { "name": "https://www.tenable.com/security/tns-2018-17", "refsource": "CONFIRM", "url": "https://www.tenable.com/security/tns-2018-17" }, { "name": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/", "refsource": "CONFIRM", "url": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/" }, { "name": "https://www.tenable.com/security/tns-2018-16", "refsource": "CONFIRM", "url": "https://www.tenable.com/security/tns-2018-16" }, { "name": "105758", "refsource": "BID", "url": "http://www.securityfocus.com/bid/105758" }, { "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7", "refsource": "CONFIRM", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7" }, { "name": "DSA-4348", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2018/dsa-4348" }, { "name": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=43e6a58d4991a451daf4891ff05a48735df871ac", "refsource": "CONFIRM", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=43e6a58d4991a451daf4891ff05a48735df871ac" }, { "name": "https://www.openssl.org/news/secadv/20181030.txt", "refsource": "CONFIRM", "url": "https://www.openssl.org/news/secadv/20181030.txt" }, { "name": "https://security.netapp.com/advisory/ntap-20190118-0002/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20190118-0002/" }, { "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html", "refsource": "MISC", "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html" }, { "name": "https://security.netapp.com/advisory/ntap-20190423-0002/", "refsource": "CONFIRM", "url": "https://security.netapp.com/advisory/ntap-20190423-0002/" }, { "name": "openSUSE-SU-2019:1547", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html" }, { "name": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html", "refsource": "MISC", "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html" }, { "name": "openSUSE-SU-2019:1814", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html" }, { "name": "RHSA-2019:2304", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "name": "FEDORA-2019-db06efdea1", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/" }, { "name": "FEDORA-2019-00c25b9379", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/" }, { "name": "FEDORA-2019-9a0a7c0986", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/" }, { "name": "RHSA-2019:3700", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3700" }, { "name": "RHSA-2019:3933", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "name": "RHSA-2019:3935", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "name": "RHSA-2019:3932", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "name": "https://www.oracle.com/security-alerts/cpujan2020.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2020.html" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2020.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "assignerShortName": "openssl", "cveId": "CVE-2018-0734", "datePublished": "2018-10-30T12:00:00Z", "dateReserved": "2017-11-30T00:00:00", "dateUpdated": "2024-09-16T23:10:36.543Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2018-0734\",\"sourceIdentifier\":\"openssl-security@openssl.org\",\"published\":\"2018-10-30T12:29:00.257\",\"lastModified\":\"2024-11-21T03:38:50.120\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).\"},{\"lang\":\"es\",\"value\":\"Se ha demostrado que el algoritmo de firmas DSA en OpenSSL es vulnerable a un ataque de sincronizaci\u00f3n de canal lateral. Un atacante podr\u00eda emplear variaciones en el algoritmo de firma para recuperar la clave privada. Se ha solucionado en OpenSSL 1.1.1a (afecta a 1.1.1). Se ha solucionado en OpenSSL 1.1.0j (afecta a 1.1.0-1.1.0i). Se ha solucionado en OpenSSL 1.0.2q (afecta a 1.0.2-1.0.2p).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-327\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.0.2\",\"versionEndIncluding\":\"1.0.2p\",\"matchCriteriaId\":\"D942BAB1-862E-455A-AAB5-6E87FA891B92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.1.0\",\"versionEndIncluding\":\"1.1.0i\",\"matchCriteriaId\":\"5953EAB1-D0E8-48EA-B07D-3B828E6BB326\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openssl:openssl:1.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F69F3542-173D-4E0D-99BB-42FDD206D996\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B5A6F2F3-4894-4392-8296-3B8DD2679084\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07C312A0-CD2C-4B9C-B064-6409B25C278F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"6.0.0\",\"versionEndIncluding\":\"6.8.1\",\"matchCriteriaId\":\"D107EC29-67E7-40C3-8E5A-324C9105C5E4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"6.9.0\",\"versionEndExcluding\":\"6.15.0\",\"matchCriteriaId\":\"2DEF4845-F577-4B12-AA48-39F0830B128E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndIncluding\":\"8.8.1\",\"matchCriteriaId\":\"74FB695D-2C76-47AB-988E-5629D2E695E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*\",\"versionStartIncluding\":\"8.9.0\",\"versionEndExcluding\":\"8.14.0\",\"matchCriteriaId\":\"7E79DFA7-55F8-453A-83E9-1C790902FCB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndIncluding\":\"10.12.0\",\"matchCriteriaId\":\"25A3180B-21AF-4010-9DAB-41ADFD2D8031\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*\",\"versionStartIncluding\":\"11.0.0\",\"versionEndExcluding\":\"11.3.0\",\"matchCriteriaId\":\"4E62EA78-C705-4AC9-9C0B-3C9114087C37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:10.13.0:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"541EAE2B-5446-46CE-BC91-13188EAD6092\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:cn1610_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB30733E-68FC-49C4-86C0-7FEE75C366BF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:cn1610:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6361DAC6-600F-4B15-8797-D67F298F46FB\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C2089EE-5D7F-47EC-8EA5-0F69790564C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBF1DFDA-FB66-4CEA-A658-B167326D1D96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"361B791A-D336-4431-8F68-8135BEFFAEA2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDFB1169-41A0-4A86-8E4F-FDA9730B1E94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:steelstore:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0DF5449D-22D2-48B4-8F50-57B43DCB15B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B7A6697-98CC-4E36-93DB-B7160F8399F9\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5553591-073B-45E3-999F-21B8BA2EEE22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:e-business_suite_technology_stack:0.9.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"913DA418-A144-48CF-85AB-75B64BFD16DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:e-business_suite_technology_stack:1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BBE38DB6-795A-479B-84A5-3DBA4A101F06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:e-business_suite_technology_stack:1.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E18AA832-DAC1-41D2-8A7C-2C41F06A2281\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98F3E643-4B65-4668-BB11-C61ED54D5A53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"459B4A5F-A6BD-4A1C-B6B7-C979F005EB70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CDCE0E90-495E-4437-8529-3C36441FB69D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AB654DFA-FEF9-4D00-ADB0-F3F2B6ACF13E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_enterprise_backup:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndIncluding\":\"3.12.3\",\"matchCriteriaId\":\"62B31BEE-88C3-431D-8356-AC28F325E76E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:mysql_enterprise_backup:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0\",\"versionEndIncluding\":\"4.1.2\",\"matchCriteriaId\":\"4340D49A-E1F8-48B7-BA05-0338293B1A14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"45CB30A1-B2C9-4BF5-B510-1F2F18B60C64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0A735B4-4F3C-416B-8C08-9CB21BAD2889\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E1E416B-920B-49A0-9523-382898C2979D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_p6_professional_project_management:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.7\",\"versionEndIncluding\":\"17.12\",\"matchCriteriaId\":\"08720A23-3B40-4394-8785-845EFEEFAA87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_p6_professional_project_management:8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7CFFE5D2-FB9A-45F9-9FBC-25A6DA9E189A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_p6_professional_project_management:15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"092AD60D-99F2-4203-966A-3002E6D9C55B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_p6_professional_project_management:15.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"273EAFA7-81C4-41A6-B44A-95BA18D9DCB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_p6_professional_project_management:16.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA25D523-25C4-4EFD-A1BC-0BEEB0EEF8AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_p6_professional_project_management:16.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F2DEE1C6-215C-47B5-A92D-E4627AD9D503\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_p6_professional_project_management:18.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BBE3E82F-DCB6-4E1E-BA08-67C85384BBB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:tuxedo:12.1.1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"92A6A7BA-CCE6-426F-8434-7A578A245180\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/105758\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2304\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3700\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3932\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3933\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3935\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/\",\"source\":\"openssl-security@openssl.org\"},{\"url\":\"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20181105-0002/\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20190118-0002/\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20190423-0002/\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/3840-1/\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2018/dsa-4348\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2018/dsa-4355\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.openssl.org/news/secadv/20181030.txt\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2020.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2018-16\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2018-17\",\"source\":\"openssl-security@openssl.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/105758\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:2304\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3700\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3932\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3933\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3935\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20181105-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20190118-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20190423-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://usn.ubuntu.com/3840-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2018/dsa-4348\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2018/dsa-4355\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.openssl.org/news/secadv/20181030.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2018-16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2018-17\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
rhsa-2019:3700
Vulnerability from csaf_redhat
Published
2019-11-05 22:28
Modified
2025-03-19 14:55
Summary
Red Hat Security Advisory: openssl security, bug fix, and enhancement update
Notes
Topic
An update for openssl is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
The following packages have been upgraded to a later upstream version: openssl (1.1.1c). (BZ#1643026)
Security Fix(es):
* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)
* openssl: timing side channel attack in the ECDSA signature generation (CVE-2018-0735)
* openssl: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Low" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openssl is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nThe following packages have been upgraded to a later upstream version: openssl (1.1.1c). (BZ#1643026)\n\nSecurity Fix(es):\n\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n\n* openssl: timing side channel attack in the ECDSA signature generation (CVE-2018-0735)\n\n* openssl: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3700", "url": "https://access.redhat.com/errata/RHSA-2019:3700" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#low", "url": "https://access.redhat.com/security/updates/classification/#low" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/" }, { "category": "external", "summary": "1644356", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644356" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1668880", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668880" }, { "category": "external", "summary": "1686058", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686058" }, { "category": "external", "summary": "1686548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686548" }, { "category": "external", "summary": "1695954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695954" }, { "category": "external", "summary": "1697915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1697915" }, { "category": "external", "summary": "1706104", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706104" }, { "category": "external", "summary": "1706915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706915" }, { "category": "external", "summary": "1712023", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712023" }, { "category": "external", "summary": "1714245", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1714245" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3700.json" } ], "title": "Red Hat Security Advisory: openssl security, bug fix, and enhancement update", "tracking": { "current_release_date": "2025-03-19T14:55:47+00:00", "generator": { "date": "2025-03-19T14:55:47+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.4.1" } }, "id": "RHSA-2019:3700", "initial_release_date": "2019-11-05T22:28:48+00:00", "revision_history": [ { "date": "2019-11-05T22:28:48+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-11-05T22:28:48+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-03-19T14:55:47+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux BaseOS (v. 8)", "product": { "name": "Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-libs-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-perl-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-devel-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-libs-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-perl-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-devel-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.i686", "product_id": "openssl-libs-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.i686", "product_id": "openssl-devel-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.i686", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.s390x", "product_id": "openssl-libs-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.s390x", "product_id": "openssl-perl-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.s390x", "product_id": "openssl-devel-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-1:1.1.1c-2.el8.s390x", "product_id": "openssl-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.src", "product": { "name": "openssl-1:1.1.1c-2.el8.src", "product_id": "openssl-1:1.1.1c-2.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src" }, "product_reference": "openssl-1:1.1.1c-2.el8.src", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-05T22:28:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3700" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0735", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644356" } ], "notes": [ { "category": "description", "text": "The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the ECDSA signature generation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0735" }, { "category": "external", "summary": "RHBZ#1644356", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644356" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0735", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0735" } ], "release_date": "2018-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-05T22:28:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3700" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the ECDSA signature generation" }, { "cve": "CVE-2019-1543", "cwe": { "id": "CWE-323", "name": "Reusing a Nonce, Key Pair in Encryption" }, "discovery_date": "2019-03-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695954" } ], "notes": [ { "category": "description", "text": "ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: ChaCha20-Poly1305 with long nonces", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1543" }, { "category": "external", "summary": "RHBZ#1695954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695954" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1543", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1543" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1543", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1543" } ], "release_date": "2019-03-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-05T22:28:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3700" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: ChaCha20-Poly1305 with long nonces" } ] }
rhsa-2019_3935
Vulnerability from csaf_redhat
Published
2019-11-20 16:08
Modified
2025-01-05 19:06
Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release
Notes
Topic
Red Hat JBoss Core Services Pack Apache Server 2.4.37 zip release
for RHEL 6, RHEL 7 and Microsoft Windows is available.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.
This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat JBoss Core Services Pack Apache Server 2.4.37 zip release\nfor RHEL 6, RHEL 7 and Microsoft Windows is available.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.\n\nThis release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3935", "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "JBCS-798", "url": "https://issues.redhat.com/browse/JBCS-798" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3935.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release", "tracking": { "current_release_date": "2025-01-05T19:06:04+00:00", "generator": { "date": "2025-01-05T19:06:04+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.5" } }, "id": "RHSA-2019:3935", "initial_release_date": "2019-11-20T16:08:18+00:00", "revision_history": [ { "date": "2019-11-20T16:08:18+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-01-06T13:01:52+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-01-05T19:06:04+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Core Services 1", "product": { "name": "Red Hat JBoss Core Services 1", "product_id": "Red Hat JBoss Core Services 1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0737", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568253" } ], "notes": [ { "category": "description", "text": "OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0737" }, { "category": "external", "summary": "RHBZ#1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2018/04/16/3", "url": "http://www.openwall.com/lists/oss-security/2018/04/16/3" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20180416.txt", "url": "https://www.openssl.org/news/secadv/20180416.txt" } ], "release_date": "2018-04-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys" }, { "acknowledgments": [ { "names": [ "Alejandro Cabrera Aldaya" ], "organization": "Universidad Tecnologica de la Habana CUJAE; Cuba" }, { "names": [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan" ] }, { "names": [ "Nicola Tuveri" ], "organization": "Tampere University of Technology; Finland" } ], "cve": "CVE-2018-5407", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1645695" } ], "notes": [ { "category": "description", "text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", "title": "Vulnerability summary" }, { "category": "other", "text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5407" }, { "category": "external", "summary": "RHBZ#1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407" }, { "category": "external", "summary": "https://github.com/bbbrumley/portsmash", "url": "https://github.com/bbbrumley/portsmash" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20181112.txt", "url": "https://www.openssl.org/news/secadv/20181112.txt" } ], "release_date": "2018-10-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", "product_ids": [ "Red Hat JBoss Core Services 1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)" }, { "cve": "CVE-2018-17189", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668497" } ], "notes": [ { "category": "description", "text": "In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: DoS via slow, unneeded request bodies", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17189" }, { "category": "external", "summary": "RHBZ#1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17189", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17189" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: DoS via slow, unneeded request bodies" }, { "cve": "CVE-2018-17199", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668493" } ], "notes": [ { "category": "description", "text": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_session_cookie does not respect expiry time", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17199" }, { "category": "external", "summary": "RHBZ#1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17199", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17199" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_session_cookie does not respect expiry time" }, { "cve": "CVE-2019-0196", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695030" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: read-after-free on a string compare", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0196" }, { "category": "external", "summary": "RHBZ#1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0196", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0196" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: read-after-free on a string compare" }, { "cve": "CVE-2019-0197", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695042" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: possible crash on late upgrade", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0197" }, { "category": "external", "summary": "RHBZ#1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0197", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0197" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-02-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: possible crash on late upgrade" }, { "cve": "CVE-2019-0217", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695020" } ], "notes": [ { "category": "description", "text": "A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_auth_digest: access control bypass due to race condition", "title": "Vulnerability summary" }, { "category": "other", "text": "Based on the the fact that digest authentication is rarely used in modern day web applications and httpd package shipped with Red Hat products do not ship threaded MPM configuration by default, this flaw has been rated as having Moderate level security impact. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0217" }, { "category": "external", "summary": "RHBZ#1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0217", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "This flaw only affects a threaded server configuration, so using the prefork MPM is an effective mitigation. In versions of httpd package shipped with Red Hat Enterprise Linux 7, the prefork MPM is the default configuration.", "product_ids": [ "Red Hat JBoss Core Services 1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_auth_digest: access control bypass due to race condition" }, { "cve": "CVE-2019-9511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741860" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: large amount of data requests leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "There are no mitigations available for nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9511" }, { "category": "external", "summary": "RHBZ#1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9511", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "Red Hat JBoss Core Services 1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: large amount of data requests leads to denial of service" }, { "acknowledgments": [ { "names": [ "the Envoy security team" ] } ], "cve": "CVE-2019-9513", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1735741" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for packages nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9513" }, { "category": "external", "summary": "RHBZ#1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9513", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9513" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/", "url": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "Red Hat JBoss Core Services 1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption" }, { "cve": "CVE-2019-9516", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741864" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: 0-length headers lead to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9516" }, { "category": "external", "summary": "RHBZ#1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9516", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9516" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://github.com/nghttp2/nghttp2/issues/1382#", "url": "https://github.com/nghttp2/nghttp2/issues/1382#" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "Red Hat JBoss Core Services 1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: 0-length headers lead to denial of service" }, { "cve": "CVE-2019-9517", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741868" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server\u0027s queue is setup, the responses can consume excess memory, CPU, or both, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: request for large response leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "The package httpd versions as shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this issue as HTTP/2 support is not provided.\nThis flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Core Services 1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9517" }, { "category": "external", "summary": "RHBZ#1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9517", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Core Services 1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps:\n\n1. Stop httpd service:\n$ systemctl stop httpd\n\n2. Remove http/2 protocol support from configuration files:\n$ sed -i \u0027s/\\(h2\\)\\|\\(h2c\\)//g\u0027 \u003chttpd_config_file\u003e\n\n3. Validate configuration files to make sure all syntax is valid:\n$ apachectl configtest\n\n4. Restart httpd service:\n$ systemctl start httpd", "product_ids": [ "Red Hat JBoss Core Services 1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Red Hat JBoss Core Services 1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: request for large response leads to denial of service" } ] }
RHSA-2019:3700
Vulnerability from csaf_redhat
Published
2019-11-05 22:28
Modified
2025-03-19 14:55
Summary
Red Hat Security Advisory: openssl security, bug fix, and enhancement update
Notes
Topic
An update for openssl is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
The following packages have been upgraded to a later upstream version: openssl (1.1.1c). (BZ#1643026)
Security Fix(es):
* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)
* openssl: timing side channel attack in the ECDSA signature generation (CVE-2018-0735)
* openssl: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Low" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openssl is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nThe following packages have been upgraded to a later upstream version: openssl (1.1.1c). (BZ#1643026)\n\nSecurity Fix(es):\n\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n\n* openssl: timing side channel attack in the ECDSA signature generation (CVE-2018-0735)\n\n* openssl: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3700", "url": "https://access.redhat.com/errata/RHSA-2019:3700" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#low", "url": "https://access.redhat.com/security/updates/classification/#low" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/" }, { "category": "external", "summary": "1644356", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644356" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1668880", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668880" }, { "category": "external", "summary": "1686058", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686058" }, { "category": "external", "summary": "1686548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686548" }, { "category": "external", "summary": "1695954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695954" }, { "category": "external", "summary": "1697915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1697915" }, { "category": "external", "summary": "1706104", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706104" }, { "category": "external", "summary": "1706915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706915" }, { "category": "external", "summary": "1712023", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712023" }, { "category": "external", "summary": "1714245", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1714245" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3700.json" } ], "title": "Red Hat Security Advisory: openssl security, bug fix, and enhancement update", "tracking": { "current_release_date": "2025-03-19T14:55:47+00:00", "generator": { "date": "2025-03-19T14:55:47+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.4.1" } }, "id": "RHSA-2019:3700", "initial_release_date": "2019-11-05T22:28:48+00:00", "revision_history": [ { "date": "2019-11-05T22:28:48+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-11-05T22:28:48+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-03-19T14:55:47+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux BaseOS (v. 8)", "product": { "name": "Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-libs-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-perl-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-devel-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-libs-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-perl-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-devel-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.i686", "product_id": "openssl-libs-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.i686", "product_id": "openssl-devel-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.i686", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.s390x", "product_id": "openssl-libs-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.s390x", "product_id": "openssl-perl-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.s390x", "product_id": "openssl-devel-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-1:1.1.1c-2.el8.s390x", "product_id": "openssl-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.src", "product": { "name": "openssl-1:1.1.1c-2.el8.src", "product_id": "openssl-1:1.1.1c-2.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src" }, "product_reference": "openssl-1:1.1.1c-2.el8.src", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-05T22:28:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3700" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0735", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644356" } ], "notes": [ { "category": "description", "text": "The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the ECDSA signature generation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0735" }, { "category": "external", "summary": "RHBZ#1644356", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644356" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0735", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0735" } ], "release_date": "2018-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-05T22:28:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3700" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the ECDSA signature generation" }, { "cve": "CVE-2019-1543", "cwe": { "id": "CWE-323", "name": "Reusing a Nonce, Key Pair in Encryption" }, "discovery_date": "2019-03-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695954" } ], "notes": [ { "category": "description", "text": "ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: ChaCha20-Poly1305 with long nonces", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1543" }, { "category": "external", "summary": "RHBZ#1695954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695954" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1543", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1543" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1543", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1543" } ], "release_date": "2019-03-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-05T22:28:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3700" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: ChaCha20-Poly1305 with long nonces" } ] }
RHBA-2020:0547
Vulnerability from csaf_redhat
Published
2020-02-18 15:13
Modified
2025-05-07 16:18
Summary
Red Hat Bug Fix Advisory: Container Image Rebuild for Ansible Tower 3.4 Dependency
Notes
Topic
Container Image Rebuild for Ansible Tower 3.4 Dependency
Details
The ansible-tower-memcached container image has been updated for Red Hat Ansible Tower 3.4 for RHEL 7 to address security advisories:
RHSA-2019:2030
RHSA-2019:2118
RHSA-2019:2136
RHSA-2019:2197
RHSA-2019:2237
RHSA-2019:2304
RHSA-2019:4190
RHSA-2020:0227
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Container Image Rebuild for Ansible Tower 3.4 Dependency", "title": "Topic" }, { "category": "general", "text": "The ansible-tower-memcached container image has been updated for Red Hat Ansible Tower 3.4 for RHEL 7 to address security advisories:\n\nRHSA-2019:2030\nRHSA-2019:2118\nRHSA-2019:2136\nRHSA-2019:2197\nRHSA-2019:2237\nRHSA-2019:2304\nRHSA-2019:4190\nRHSA-2020:0227", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHBA-2020:0547", "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2030", "url": "https://access.redhat.com/errata/RHSA-2019:2030" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2118", "url": "https://access.redhat.com/errata/RHSA-2019:2118" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2136", "url": "https://access.redhat.com/errata/RHSA-2019:2136" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2197", "url": "https://access.redhat.com/errata/RHSA-2019:2197" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2237", "url": "https://access.redhat.com/errata/RHSA-2019:2237" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2304", "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:4190", "url": "https://access.redhat.com/errata/RHSA-2019:4190" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2020:0227", "url": "https://access.redhat.com/errata/RHSA-2020:0227" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_0547.json" } ], "title": "Red Hat Bug Fix Advisory: Container Image Rebuild for Ansible Tower 3.4 Dependency", "tracking": { "current_release_date": "2025-05-07T16:18:49+00:00", "generator": { "date": "2025-05-07T16:18:49+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.5.0" } }, "id": "RHBA-2020:0547", "initial_release_date": "2020-02-18T15:13:57+00:00", "revision_history": [ { "date": "2020-02-18T15:13:57+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-02-18T15:13:57+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-05-07T16:18:49+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product": { "name": "Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:ansible_tower:3.4::el7" } } } ], "category": "product_family", "name": "Red Hat Ansible Tower" }, { "branches": [ { "category": "product_version", "name": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product": { "name": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_id": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_identification_helper": { "purl": "pkg:oci/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-37/ansible-tower-memcached-rhel7\u0026tag=1.4.15-28" } } }, { "category": "product_version", "name": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product": { "name": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_id": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_identification_helper": { "purl": "pkg:oci/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-35/ansible-tower-memcached\u0026tag=1.4.15-28" } } }, { "category": "product_version", "name": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product": { "name": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_id": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_identification_helper": { "purl": "pkg:oci/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-34/ansible-tower-memcached\u0026tag=1.4.15-28" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64 as a component of Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" }, "product_reference": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "relates_to_product_reference": "7Server-Ansible-Tower-3.4" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64 as a component of Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" }, "product_reference": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "relates_to_product_reference": "7Server-Ansible-Tower-3.4" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64 as a component of Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" }, "product_reference": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "relates_to_product_reference": "7Server-Ansible-Tower-3.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-10739", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2016-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1347549" } ], "notes": [ { "category": "description", "text": "In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.", "title": "Vulnerability description" }, { "category": "summary", "text": "glibc: getaddrinfo should reject IP addresses with trailing characters", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-10739" }, { "category": "external", "summary": "RHBZ#1347549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1347549" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-10739", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10739" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10739", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10739" } ], "release_date": "2016-04-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glibc: getaddrinfo should reject IP addresses with trailing characters" }, { "cve": "CVE-2018-0495", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-06-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1591163" } ], "notes": [ { "category": "description", "text": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.", "title": "Vulnerability description" }, { "category": "summary", "text": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries", "title": "Vulnerability summary" }, { "category": "other", "text": "Since the 5.8.3 release, Red Hat CloudForms no longer uses libtomcrypt.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0495" }, { "category": "external", "summary": "RHBZ#1591163", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1591163" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0495", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0495" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0495", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0495" }, { "category": "external", "summary": "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/", "url": "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/" } ], "release_date": "2018-06-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries" }, { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "acknowledgments": [ { "names": [ "Qualys Research Labs" ] } ], "cve": "CVE-2018-1122", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2018-05-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1575466" } ], "notes": [ { "category": "description", "text": "If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.", "title": "Vulnerability description" }, { "category": "summary", "text": "procps: Local privilege escalation in top", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-1122" }, { "category": "external", "summary": "RHBZ#1575466", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575466" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1122", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1122" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1122", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1122" }, { "category": "external", "summary": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt", "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt" } ], "release_date": "2018-05-17T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "procps: Local privilege escalation in top" }, { "cve": "CVE-2018-5818", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "discovery_date": "2018-12-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1661608" } ], "notes": [ { "category": "description", "text": "An error within the \"parse_rollei()\" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.", "title": "Vulnerability description" }, { "category": "summary", "text": "LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5818" }, { "category": "external", "summary": "RHBZ#1661608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1661608" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5818", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5818" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5818", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5818" } ], "release_date": "2018-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp" }, { "cve": "CVE-2018-5819", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-12-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1661604" } ], "notes": [ { "category": "description", "text": "An error within the \"parse_sinar_ia()\" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.", "title": "Vulnerability description" }, { "category": "summary", "text": "LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5819" }, { "category": "external", "summary": "RHBZ#1661604", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1661604" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5819", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5819" } ], "release_date": "2018-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp" }, { "cve": "CVE-2018-12404", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-12-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1657913" } ], "notes": [ { "category": "description", "text": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.", "title": "Vulnerability description" }, { "category": "summary", "text": "nss: Cache side-channel variant of the Bleichenbacher attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-12404" }, { "category": "external", "summary": "RHBZ#1657913", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1657913" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12404", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12404" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12404", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12404" } ], "release_date": "2018-11-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nss: Cache side-channel variant of the Bleichenbacher attack" }, { "cve": "CVE-2018-12641", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-06-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1594410" } ], "notes": [ { "category": "description", "text": "An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg, demangle_args, and demangle_nested_args. This can occur during execution of nm-new.", "title": "Vulnerability description" }, { "category": "summary", "text": "binutils: Stack Exhaustion in the demangling functions provided by libiberty", "title": "Vulnerability summary" }, { "category": "other", "text": "The issue is classified as low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting its exploitation potential. The stack overflow in demangle_class_name() only triggers during the parsing of malformed ELF files, which would require an attacker to convince a user to process a malicious file with binutils. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-12641" }, { "category": "external", "summary": "RHBZ#1594410", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1594410" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12641", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12641" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12641", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12641" } ], "release_date": "2018-04-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "binutils: Stack Exhaustion in the demangling functions provided by libiberty" }, { "cve": "CVE-2018-12697", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2018-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1595417" } ], "notes": [ { "category": "description", "text": "A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.", "title": "Vulnerability description" }, { "category": "summary", "text": "binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c.", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this NULL pointer dereference is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with objdump. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-12697" }, { "category": "external", "summary": "RHBZ#1595417", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595417" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12697", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12697" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12697", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12697" } ], "release_date": "2018-04-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c." }, { "acknowledgments": [ { "names": [ "the Curl project" ] }, { "names": [ "Zhaoyang Wu" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2018-14618", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2018-08-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1622707" } ], "notes": [ { "category": "description", "text": "curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)", "title": "Vulnerability description" }, { "category": "summary", "text": "curl: NTLM password overflow via integer overflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14618" }, { "category": "external", "summary": "RHBZ#1622707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1622707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14618", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14618" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14618", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14618" }, { "category": "external", "summary": "https://curl.haxx.se/docs/CVE-2018-14618.html", "url": "https://curl.haxx.se/docs/CVE-2018-14618.html" } ], "release_date": "2018-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "curl: NTLM password overflow via integer overflow" }, { "acknowledgments": [ { "names": [ "the Python Security Response Team" ] } ], "cve": "CVE-2018-14647", "cwe": { "id": "CWE-335", "name": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)" }, "discovery_date": "2018-09-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1631822" } ], "notes": [ { "category": "description", "text": "Python\u0027s elementtree C accelerator failed to initialise Expat\u0027s hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat\u0027s internal data structures, consuming large amounts CPU and RAM.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: Missing salt initialization in _elementtree.c module", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14647" }, { "category": "external", "summary": "RHBZ#1631822", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1631822" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14647", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14647" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14647", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14647" }, { "category": "external", "summary": "https://bugs.python.org/issue34623", "url": "https://bugs.python.org/issue34623" } ], "release_date": "2018-09-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: Missing salt initialization in _elementtree.c module" }, { "acknowledgments": [ { "names": [ "Jann Horn" ], "organization": "Google Project Zero" }, { "names": [ "Ubuntu" ] } ], "cve": "CVE-2018-15686", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2018-10-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1639071" } ], "notes": [ { "category": "description", "text": "It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service. Properties longer than LINE_MAX are not correctly parsed and an attacker may abuse this flaw in particularly configured services to inject, change, or corrupt the service state.", "title": "Vulnerability description" }, { "category": "summary", "text": "systemd: line splitting via fgets() allows for state injection during daemon-reexec", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-15686" }, { "category": "external", "summary": "RHBZ#1639071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1639071" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-15686", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15686" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-15686", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15686" } ], "release_date": "2018-10-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "systemd: line splitting via fgets() allows for state injection during daemon-reexec" }, { "cve": "CVE-2018-16062", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-08-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1623752" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read was discovered in elfutils in the way it reads DWARF address ranges information. Function dwarf_getaranges() in dwarf_getaranges.c does not properly check whether it reads beyond the limits of the ELF section. An attacker could use this flaw to cause a denial of service via a crafted file.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16062" }, { "category": "external", "summary": "RHBZ#1623752", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1623752" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16062", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16062" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16062", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16062" } ], "release_date": "2018-08-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file" }, { "cve": "CVE-2018-16402", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1625050" } ], "notes": [ { "category": "description", "text": "libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Double-free due to double decompression of sections in crafted ELF causes crash", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16402" }, { "category": "external", "summary": "RHBZ#1625050", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1625050" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16402", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16402" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16402", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16402" } ], "release_date": "2018-08-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Double-free due to double decompression of sections in crafted ELF causes crash" }, { "cve": "CVE-2018-16403", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1625055" } ], "notes": [ { "category": "description", "text": "libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16403" }, { "category": "external", "summary": "RHBZ#1625055", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1625055" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16403", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16403" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16403", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16403" } ], "release_date": "2018-08-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash" }, { "acknowledgments": [ { "names": [ "the Curl project" ] }, { "names": [ "Brian Carpenter" ], "organization": "Geeknik Labs", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2018-16842", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644124" } ], "notes": [ { "category": "description", "text": "Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "curl: Heap-based buffer over-read in the curl tool warning formatting", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16842" }, { "category": "external", "summary": "RHBZ#1644124", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644124" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16842", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16842" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16842", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16842" }, { "category": "external", "summary": "https://curl.haxx.se/docs/CVE-2018-16842.html", "url": "https://curl.haxx.se/docs/CVE-2018-16842.html" } ], "release_date": "2018-10-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "curl: Heap-based buffer over-read in the curl tool warning formatting" }, { "acknowledgments": [ { "names": [ "Qualys Research Labs" ] } ], "cve": "CVE-2018-16866", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1653867" } ], "notes": [ { "category": "description", "text": "An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon \u0027:\u0027. A local attacker can use this flaw to disclose process memory data.", "title": "Vulnerability description" }, { "category": "summary", "text": "systemd: out-of-bounds read when parsing a crafted syslog message", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of systemd as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having a security impact of Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.\n\nRed Hat Virtualization Hypervisor and Management Appliance include vulnerable versions of systemd. However, since exploitation requires local access and impact is restricted to information disclosure, this flaw is rated as having a security issue of Low. Future updates may address this issue.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16866" }, { "category": "external", "summary": "RHBZ#1653867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1653867" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16866", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16866" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16866", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16866" }, { "category": "external", "summary": "https://www.qualys.com/2019/01/09/system-down/system-down.txt", "url": "https://www.qualys.com/2019/01/09/system-down/system-down.txt" } ], "release_date": "2019-01-09T18:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "systemd: out-of-bounds read when parsing a crafted syslog message" }, { "cve": "CVE-2018-16888", "cwe": { "id": "CWE-250", "name": "Execution with Unnecessary Privileges" }, "discovery_date": "2019-01-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1662867" } ], "notes": [ { "category": "description", "text": "It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes.", "title": "Vulnerability description" }, { "category": "summary", "text": "systemd: kills privileged process if unprivileged PIDFile was tampered", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16888" }, { "category": "external", "summary": "RHBZ#1662867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1662867" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16888", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16888" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16888", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16888" } ], "release_date": "2017-08-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "systemd: kills privileged process if unprivileged PIDFile was tampered" }, { "cve": "CVE-2018-18310", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-10-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1642604" } ], "notes": [ { "category": "description", "text": "An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of elfutils as shipped with Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18310" }, { "category": "external", "summary": "RHBZ#1642604", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1642604" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18310", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18310" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18310", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18310" } ], "release_date": "2018-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl" }, { "cve": "CVE-2018-18520", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2018-10-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1646477" } ], "notes": [ { "category": "description", "text": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: eu-size cannot handle recursive ar files", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of elfutils as shipped with Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18520" }, { "category": "external", "summary": "RHBZ#1646477", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646477" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18520", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18520" } ], "release_date": "2018-10-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: eu-size cannot handle recursive ar files" }, { "cve": "CVE-2018-18521", "cwe": { "id": "CWE-369", "name": "Divide By Zero" }, "discovery_date": "2018-10-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1646482" } ], "notes": [ { "category": "description", "text": "Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of elfutils as shipped with Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18521" }, { "category": "external", "summary": "RHBZ#1646482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646482" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18521", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18521" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18521", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18521" } ], "release_date": "2018-10-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c" }, { "cve": "CVE-2018-20217", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "discovery_date": "2018-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1665296" } ], "notes": [ { "category": "description", "text": "A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.", "title": "Vulnerability description" }, { "category": "summary", "text": "krb5: Reachable assertion in the KDC using S4U2Self requests", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-20217" }, { "category": "external", "summary": "RHBZ#1665296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1665296" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-20217", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-20217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20217" } ], "release_date": "2018-12-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "krb5: Reachable assertion in the KDC using S4U2Self requests" }, { "cve": "CVE-2018-1000876", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2018-12-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1664699" } ], "notes": [ { "category": "description", "text": "binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.", "title": "Vulnerability description" }, { "category": "summary", "text": "binutils: integer overflow leads to heap-based buffer overflow in objdump", "title": "Vulnerability summary" }, { "category": "other", "text": "The issue is classified as moderate severity primarily because of the unlikelihood of running a 32bit compiled objdump and/or having a compiled binary that uses 32bit compiled binutils libraries to analyze binaries from a not trusted source. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security. \n\nAs per upstream binutils security policy this issue is not considered as a security flaw. Basically the key element of the policy that affects this is the understanding that analysis of untrusted binaries must always be done in a sandbox because the ELF format is open ended enough to make the analysis tools do anything, like including and processing arbitrary files. This eliminates the only possible vulnerability vector here, which is the possibility of a user being tricked into downloading and analyzing an untrusted ELF without sandboxing.\n\nSee the binutils security policy for more details:\nhttps://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-190: Integer Overflow leading to a CWE-122: Heap-based Buffer Overflow vulnerability, and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nAccess to the platform is granted only after successful hard token-based multi-factor authentication (MFA) and enforced through least privilege, ensuring only authorized users can execute or modify code. Red Hat also applies least functionality, enabling only essential features, services, and ports to reduce the attack surface for heap-based buffer overflow exploits. The environment uses IPS/IDS and antimalware solutions to detect and respond to threats in real time, helping prevent or limit exploitation attempts. Static code analysis and peer reviews ensure all user inputs are thoroughly validated, reducing the risk of system instability, data exposure, or privilege escalation. Finally, memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) enhance resilience against buffer overflows and denial-of-service attacks.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-1000876" }, { "category": "external", "summary": "RHBZ#1664699", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1664699" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1000876", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000876" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000876", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000876" } ], "release_date": "2018-12-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "binutils: integer overflow leads to heap-based buffer overflow in objdump" }, { "cve": "CVE-2019-1559", "cwe": { "id": "CWE-325", "name": "Missing Cryptographic Step" }, "discovery_date": "2019-02-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1683804" } ], "notes": [ { "category": "description", "text": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: 0-byte record padding oracle", "title": "Vulnerability summary" }, { "category": "other", "text": "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1559" }, { "category": "external", "summary": "RHBZ#1683804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1559", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1559" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559" }, { "category": "external", "summary": "https://github.com/RUB-NDS/TLS-Padding-Oracles", "url": "https://github.com/RUB-NDS/TLS-Padding-Oracles" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20190226.txt", "url": "https://www.openssl.org/news/secadv/20190226.txt" } ], "release_date": "2019-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: 0-byte record padding oracle" }, { "acknowledgments": [ { "names": [ "the libssh2 project" ] }, { "names": [ "Chris Coulson" ], "organization": "Canonical Ltd.", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-3858", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-03-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1687306" } ], "notes": [ { "category": "description", "text": "An out of bounds read flaw was discovered in libssh2 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.\n\nlibssh2 is no longer included in the virt module since Red Hat Enterprise Linux 8.1.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-3858" }, { "category": "external", "summary": "RHBZ#1687306", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687306" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3858", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3858" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3858", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3858" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3858.html", "url": "https://www.libssh2.org/CVE-2019-3858.html" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read" }, { "acknowledgments": [ { "names": [ "the libssh2 project" ] }, { "names": [ "Chris Coulson" ], "organization": "Canonical Ltd.", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-3861", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-03-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1687311" } ], "notes": [ { "category": "description", "text": "An out of bounds read flaw was discovered in libssh2 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh2: Out-of-bounds reads with specially crafted SSH packets", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.\n\nlibssh2 is no longer included in the virt module since Red Hat Enterprise Linux 8.1.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-3861" }, { "category": "external", "summary": "RHBZ#1687311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687311" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3861", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3861" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3861", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3861" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3861.html", "url": "https://www.libssh2.org/CVE-2019-3861.html" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libssh2: Out-of-bounds reads with specially crafted SSH packets" }, { "acknowledgments": [ { "names": [ "the libssh2 project" ] }, { "names": [ "Chris Coulson" ], "organization": "Canonical Ltd.", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-3862", "cwe": { "id": "CWE-130", "name": "Improper Handling of Length Parameter Inconsistency" }, "discovery_date": "2019-03-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1687312" } ], "notes": [ { "category": "description", "text": "An out of bounds read flaw was discovered in libssh2 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh2: Out-of-bounds memory comparison with specially crafted message channel request", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.\n\nlibssh2 is no longer included in the virt module since Red Hat Enterprise Linux 8.1.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-3862" }, { "category": "external", "summary": "RHBZ#1687312", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687312" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3862", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3862" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3862", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3862" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3862.html", "url": "https://www.libssh2.org/CVE-2019-3862.html" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libssh2: Out-of-bounds memory comparison with specially crafted message channel request" }, { "cve": "CVE-2019-5010", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2019-01-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1666519" } ], "notes": [ { "category": "description", "text": "A null pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: NULL pointer dereference using a specially crafted X509 certificate", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue did not affect the versions of python as shipped with Red Hat Enterprise Linux 5 and 6.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5010" }, { "category": "external", "summary": "RHBZ#1666519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666519" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5010", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5010" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5010", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5010" }, { "category": "external", "summary": "https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html", "url": "https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html" } ], "release_date": "2019-01-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: NULL pointer dereference using a specially crafted X509 certificate" }, { "cve": "CVE-2019-7149", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-01-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1671443" } ], "notes": [ { "category": "description", "text": "A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7149" }, { "category": "external", "summary": "RHBZ#1671443", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671443" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7149", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7149" } ], "release_date": "2019-01-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw" }, { "cve": "CVE-2019-7150", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-01-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1671446" } ], "notes": [ { "category": "description", "text": "An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7150" }, { "category": "external", "summary": "RHBZ#1671446", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671446" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7150", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7150" } ], "release_date": "2018-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c" }, { "cve": "CVE-2019-7664", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2019-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1677536" } ], "notes": [ { "category": "description", "text": "In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7664" }, { "category": "external", "summary": "RHBZ#1677536", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677536" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7664", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7664" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7664", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7664" } ], "release_date": "2019-01-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h" }, { "cve": "CVE-2019-7665", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2019-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1677538" } ], "notes": [ { "category": "description", "text": "In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7665" }, { "category": "external", "summary": "RHBZ#1677538", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677538" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7665", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7665" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7665", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7665" } ], "release_date": "2019-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c" }, { "cve": "CVE-2019-9740", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688169" } ], "notes": [ { "category": "description", "text": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: CRLF injection via the query part of the url passed to urlopen()", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects:\n* All current versions of Red Hat OpenStack Platform. However, version 8 is due to retire on the 20th of April 2019, there are no more planned releases prior to this date.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9740" }, { "category": "external", "summary": "RHBZ#1688169", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688169" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9740", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9740" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9740", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9740" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: CRLF injection via the query part of the url passed to urlopen()" }, { "cve": "CVE-2019-9947", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695572" } ], "notes": [ { "category": "description", "text": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: CRLF injection via the path part of the url passed to urlopen()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9947" }, { "category": "external", "summary": "RHBZ#1695572", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695572" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9947", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9947" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9947", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9947" } ], "release_date": "2019-03-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: CRLF injection via the path part of the url passed to urlopen()" }, { "cve": "CVE-2019-9948", "cwe": { "id": "CWE-749", "name": "Exposed Dangerous Method or Function" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695570" } ], "notes": [ { "category": "description", "text": "urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen(\u0027local_file:///etc/passwd\u0027) call.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9948" }, { "category": "external", "summary": "RHBZ#1695570", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695570" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9948", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9948" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9948", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9948" } ], "release_date": "2019-03-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "If your application uses a blacklist to prevent \"file://\" schema from being used, consider using a whitelist approach to just allow the schemas you want or add \"local_file://\" schema to your blacklist.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Jonas Allmann" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11729", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-07-10T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1728437" } ], "notes": [ { "category": "description", "text": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.", "title": "Vulnerability description" }, { "category": "summary", "text": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault", "title": "Vulnerability summary" }, { "category": "other", "text": "Firefox on Red Hat Enterprise Linux is built against the system nss library.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11729" }, { "category": "external", "summary": "RHBZ#1728437", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728437" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11729", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11729" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11729", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11729" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729" } ], "release_date": "2019-07-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault" }, { "acknowledgments": [ { "names": [ "the Mozilla Project" ] } ], "cve": "CVE-2019-11745", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2019-11-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1774831" } ], "notes": [ { "category": "description", "text": "A heap-based buffer overflow was found in the NSC_EncryptUpdate() function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or decrypt operations, to execute arbitrary code with the permissions of the user running the application (compiled with nss). While the attack complexity is high, the impact to confidentiality, integrity, and availability are high as well.", "title": "Vulnerability description" }, { "category": "summary", "text": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate", "title": "Vulnerability summary" }, { "category": "other", "text": "Firefox and Thunderbird on Red Hat Enterprise Linux are built against the system nss library.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11745" }, { "category": "external", "summary": "RHBZ#1774831", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1774831" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11745", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11745" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11745", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11745" }, { "category": "external", "summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes", "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes" }, { "category": "external", "summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes", "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes" } ], "release_date": "2019-11-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate" }, { "cve": "CVE-2019-13734", "discovery_date": "2019-12-10T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1781980" } ], "notes": [ { "category": "description", "text": "Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "sqlite: fts3: improve shadow table corruption detection", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-13734" }, { "category": "external", "summary": "RHBZ#1781980", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1781980" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-13734", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-13734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13734" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html" } ], "release_date": "2019-12-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "sqlite: fts3: improve shadow table corruption detection" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1734", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)" }, "discovery_date": "2019-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1801804" } ], "notes": [ { "category": "description", "text": "A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: shell enabled by default in a pipe lookup plugin subprocess", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1734" }, { "category": "external", "summary": "RHBZ#1801804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801804" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1734", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1734" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "This issue can be avoided by escaping variables which are used in the lookup.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ansible: shell enabled by default in a pipe lookup plugin subprocess" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1735", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802085" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: path injection on dest parameter in fetch module", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1735" }, { "category": "external", "summary": "RHBZ#1802085", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802085" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1735", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1735" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except avoid using the affected fetch module when possible.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ansible: path injection on dest parameter in fetch module" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1736", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802124" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This issue affects only the newly created files and not existing ones. If the file already exists at the final destination, those permissions are retained. This could lead to the disclosure of sensitive data.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: atomic_move primitive sets permissive permissions", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.8.14 and 2.9.12 as well as previous versions and all 2.7.x versions are affected.\n\nAnsible Tower 3.6.5 and 3.7.2 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1736" }, { "category": "external", "summary": "RHBZ#1802124", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802124" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1736", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1736" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1736", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1736" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "This issue can be mitigated by specifying the \"mode\" on the task. That just leaves a race condition in place where newly created files that specify a mode in the task briefly go from 666 - umask to the final mode. An alternative workaround if many new files are created and to avoid setting a specific mode for each file would be to set the \"mode\" to \"preserve\" value. That will maintain the permissions of the source file on the controller in the final file on the managed host.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: atomic_move primitive sets permissive permissions" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1737", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2020-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802154" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: Extract-Zip function in win_unzip module does not check extracted path", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1737" }, { "category": "external", "summary": "RHBZ#1802154", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802154" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1737", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1737" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except avoid using the affected win_unzip module when possible.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ansible: Extract-Zip function in win_unzip module does not check extracted path" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1738", "cwe": { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802164" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine when the module package or service is used and the parameter \u0027use\u0027 is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: module package can be selected by the ansible facts", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1738" }, { "category": "external", "summary": "RHBZ#1802164", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802164" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1738", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1738" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1738", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1738" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Specify the parameter \u0027use\u0027 when possible on the package and service modules. Avoid using Ansible Collections on Ansible 2.8.9 or 2.7.16 (and any of the previous versions) as they are not rejecting python with no path (already fixed in 2.9.x).", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: module package can be selected by the ansible facts" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1739", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802178" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine. When a password is set with the argument \"password\" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: svn module leaks password when specified as a parameter", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1739" }, { "category": "external", "summary": "RHBZ#1802178", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802178" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1739", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1739" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1739", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1739" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Instead of using the parameter \u0027password\u0027 of the subversion module, provide the password with stdin.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: svn module leaks password when specified as a parameter" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1740", "cwe": { "id": "CWE-377", "name": "Insecure Temporary File" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802193" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes \"ansible-vault edit\", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: secrets readable after ansible-vault edit", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1740" }, { "category": "external", "summary": "RHBZ#1802193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802193" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1740", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1740" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1740", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1740" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except avoid using the \u0027edit\u0027 option from \u0027ansible-vault\u0027 command line tool.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: secrets readable after ansible-vault edit" }, { "acknowledgments": [ { "names": [ "Felix Fountein" ] } ], "cve": "CVE-2020-1746", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2019-12-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1805491" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: Information disclosure issue in ldap_attr and ldap_entry modules", "title": "Vulnerability summary" }, { "category": "other", "text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\n* Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be provided from core Ansible. But we still ship ansible separately for ceph ubuntu.\n\n* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1746" }, { "category": "external", "summary": "RHBZ#1805491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805491" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1746", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1746" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1746", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1746" } ], "release_date": "2020-02-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Using args keyword and embedding the ldap_auth variable instead of using bind_pw parameter would mitigate this issue.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: Information disclosure issue in ldap_attr and ldap_entry modules" }, { "acknowledgments": [ { "names": [ "Abhijeet Kasurde" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-1753", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2020-03-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1811008" } ], "notes": [ { "category": "description", "text": "A security flaw was found in the Ansible Engine when managing Kubernetes using the k8s connection plugin. Sensitive parameters such as passwords and tokens are passed to the kubectl command line instead of using environment variables or an input configuration file, which is safer. This flaw discloses passwords and tokens from the process list, and the no_log directive from the debug module would not be reflected in the underlying command-line tools options, displaying passwords and tokens on stdout and log files.", "title": "Vulnerability description" }, { "category": "summary", "text": "Ansible: kubectl connection plugin leaks sensitive information", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.17, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1753" }, { "category": "external", "summary": "RHBZ#1811008", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811008" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1753", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1753" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1753", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1753" } ], "release_date": "2020-03-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Ansible: kubectl connection plugin leaks sensitive information" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-10684", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1815519" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine. When using ansible_facts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansible_facts after the clean, an attacker could take advantage of this by altering the ansible_facts leading to privilege escalation or code injection. The highest threat from this vulnerability are to data integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "Ansible: code injection when using ansible_facts as a subkey", "title": "Vulnerability summary" }, { "category": "other", "text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n* Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be consumed from core Ansible. But we still ship ansible separately for ceph ubuntu.\n* Red Hat OpenStack Platform does package the affected code. However, because RHOSP does not use ansible_facts as a subkey directly, the RHOSP impact has been reduced to Moderate and no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10684" }, { "category": "external", "summary": "RHBZ#1815519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815519" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10684", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10684" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10684", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10684" } ], "release_date": "2020-03-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is not a known mitigation except avoiding the functionality of using ansible_facts as a subkey.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Ansible: code injection when using ansible_facts as a subkey" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-10685", "cwe": { "id": "CWE-459", "name": "Incomplete Cleanup" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1814627" } ], "notes": [ { "category": "description", "text": "A flaw was found on Ansible Engine when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the secrets unencrypted.\r\n\r\nOn Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decrypted data remains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted is sensible.", "title": "Vulnerability description" }, { "category": "summary", "text": "Ansible: modules which use files encrypted with vault are not properly cleaned up", "title": "Vulnerability summary" }, { "category": "other", "text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\n* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10685" }, { "category": "external", "summary": "RHBZ#1814627", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814627" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10685", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10685" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685" } ], "release_date": "2020-03-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except by removing manually the temporary created file after every run.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Ansible: modules which use files encrypted with vault are not properly cleaned up" } ] }
RHSA-2019:2304
Vulnerability from csaf_redhat
Published
2019-08-06 13:42
Modified
2025-03-15 19:41
Summary
Red Hat Security Advisory: openssl security and bug fix update
Notes
Topic
An update for openssl is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
Security Fix(es):
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openssl is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: 0-byte record padding oracle (CVE-2019-1559)\n\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:2304", "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1649568", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1649568" }, { "category": "external", "summary": "1683804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2304.json" } ], "title": "Red Hat Security Advisory: openssl security and bug fix update", "tracking": { "current_release_date": "2025-03-15T19:41:25+00:00", "generator": { "date": "2025-03-15T19:41:25+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.4.1" } }, "id": "RHSA-2019:2304", "initial_release_date": "2019-08-06T13:42:09+00:00", "revision_history": [ { "date": "2019-08-06T13:42:09+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-08-06T13:42:09+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-03-15T19:41:25+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ComputeNode (v. 7)", "product": { "name": "Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-perl-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-static-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-devel-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-libs-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-static-1:1.0.2k-19.el7.i686", "product_id": "openssl-static-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.i686", "product_id": "openssl-devel-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.i686", "product_id": "openssl-libs-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.src", "product": { "name": "openssl-1:1.0.2k-19.el7.src", "product_id": "openssl-1:1.0.2k-19.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x", "product_id": "openssl-perl-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-static-1:1.0.2k-19.el7.s390x", "product_id": "openssl-static-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-1:1.0.2k-19.el7.s390x", "product_id": "openssl-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x", "product_id": "openssl-devel-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x", "product_id": "openssl-libs-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-static-1:1.0.2k-19.el7.s390", "product_id": "openssl-static-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.s390", "product_id": "openssl-devel-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.s390", "product_id": "openssl-libs-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } } ], "category": "architecture", "name": "s390" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-perl-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-static-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-devel-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-libs-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-static-1:1.0.2k-19.el7.ppc", "product_id": "openssl-static-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc", "product_id": "openssl-devel-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc", "product_id": "openssl-libs-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-static-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T13:42:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2304" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2019-1559", "cwe": { "id": "CWE-325", "name": "Missing Cryptographic Step" }, "discovery_date": "2019-02-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1683804" } ], "notes": [ { "category": "description", "text": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: 0-byte record padding oracle", "title": "Vulnerability summary" }, { "category": "other", "text": "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1559" }, { "category": "external", "summary": "RHBZ#1683804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1559", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1559" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559" }, { "category": "external", "summary": "https://github.com/RUB-NDS/TLS-Padding-Oracles", "url": "https://github.com/RUB-NDS/TLS-Padding-Oracles" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20190226.txt", "url": "https://www.openssl.org/news/secadv/20190226.txt" } ], "release_date": "2019-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T13:42:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "workaround", "details": "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", "product_ids": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: 0-byte record padding oracle" } ] }
rhba-2020_0547
Vulnerability from csaf_redhat
Published
2020-02-18 15:13
Modified
2024-11-22 14:26
Summary
Red Hat Bug Fix Advisory: Container Image Rebuild for Ansible Tower 3.4 Dependency
Notes
Topic
Container Image Rebuild for Ansible Tower 3.4 Dependency
Details
The ansible-tower-memcached container image has been updated for Red Hat Ansible Tower 3.4 for RHEL 7 to address security advisories:
RHSA-2019:2030
RHSA-2019:2118
RHSA-2019:2136
RHSA-2019:2197
RHSA-2019:2237
RHSA-2019:2304
RHSA-2019:4190
RHSA-2020:0227
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Container Image Rebuild for Ansible Tower 3.4 Dependency", "title": "Topic" }, { "category": "general", "text": "The ansible-tower-memcached container image has been updated for Red Hat Ansible Tower 3.4 for RHEL 7 to address security advisories:\n\nRHSA-2019:2030\nRHSA-2019:2118\nRHSA-2019:2136\nRHSA-2019:2197\nRHSA-2019:2237\nRHSA-2019:2304\nRHSA-2019:4190\nRHSA-2020:0227", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHBA-2020:0547", "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2030", "url": "https://access.redhat.com/errata/RHSA-2019:2030" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2118", "url": "https://access.redhat.com/errata/RHSA-2019:2118" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2136", "url": "https://access.redhat.com/errata/RHSA-2019:2136" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2197", "url": "https://access.redhat.com/errata/RHSA-2019:2197" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2237", "url": "https://access.redhat.com/errata/RHSA-2019:2237" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2304", "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:4190", "url": "https://access.redhat.com/errata/RHSA-2019:4190" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2020:0227", "url": "https://access.redhat.com/errata/RHSA-2020:0227" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_0547.json" } ], "title": "Red Hat Bug Fix Advisory: Container Image Rebuild for Ansible Tower 3.4 Dependency", "tracking": { "current_release_date": "2024-11-22T14:26:18+00:00", "generator": { "date": "2024-11-22T14:26:18+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHBA-2020:0547", "initial_release_date": "2020-02-18T15:13:57+00:00", "revision_history": [ { "date": "2020-02-18T15:13:57+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-02-18T15:13:57+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T14:26:18+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product": { "name": "Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:ansible_tower:3.4::el7" } } } ], "category": "product_family", "name": "Red Hat Ansible Tower" }, { "branches": [ { "category": "product_version", "name": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product": { "name": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_id": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_identification_helper": { "purl": "pkg:oci/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-37/ansible-tower-memcached-rhel7\u0026tag=1.4.15-28" } } }, { "category": "product_version", "name": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product": { "name": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_id": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_identification_helper": { "purl": "pkg:oci/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-35/ansible-tower-memcached\u0026tag=1.4.15-28" } } }, { "category": "product_version", "name": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product": { "name": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_id": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_identification_helper": { "purl": "pkg:oci/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-34/ansible-tower-memcached\u0026tag=1.4.15-28" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64 as a component of Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" }, "product_reference": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "relates_to_product_reference": "7Server-Ansible-Tower-3.4" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64 as a component of Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" }, "product_reference": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "relates_to_product_reference": "7Server-Ansible-Tower-3.4" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64 as a component of Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" }, "product_reference": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "relates_to_product_reference": "7Server-Ansible-Tower-3.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-10739", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2016-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1347549" } ], "notes": [ { "category": "description", "text": "In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.", "title": "Vulnerability description" }, { "category": "summary", "text": "glibc: getaddrinfo should reject IP addresses with trailing characters", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-10739" }, { "category": "external", "summary": "RHBZ#1347549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1347549" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-10739", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10739" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10739", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10739" } ], "release_date": "2016-04-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glibc: getaddrinfo should reject IP addresses with trailing characters" }, { "cve": "CVE-2018-0495", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-06-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1591163" } ], "notes": [ { "category": "description", "text": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.", "title": "Vulnerability description" }, { "category": "summary", "text": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries", "title": "Vulnerability summary" }, { "category": "other", "text": "Since the 5.8.3 release, Red Hat CloudForms no longer uses libtomcrypt.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0495" }, { "category": "external", "summary": "RHBZ#1591163", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1591163" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0495", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0495" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0495", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0495" }, { "category": "external", "summary": "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/", "url": "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/" } ], "release_date": "2018-06-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries" }, { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "acknowledgments": [ { "names": [ "Qualys Research Labs" ] } ], "cve": "CVE-2018-1122", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2018-05-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1575466" } ], "notes": [ { "category": "description", "text": "If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.", "title": "Vulnerability description" }, { "category": "summary", "text": "procps: Local privilege escalation in top", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-1122" }, { "category": "external", "summary": "RHBZ#1575466", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575466" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1122", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1122" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1122", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1122" }, { "category": "external", "summary": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt", "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt" } ], "release_date": "2018-05-17T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "procps: Local privilege escalation in top" }, { "cve": "CVE-2018-5818", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "discovery_date": "2018-12-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1661608" } ], "notes": [ { "category": "description", "text": "An error within the \"parse_rollei()\" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.", "title": "Vulnerability description" }, { "category": "summary", "text": "LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5818" }, { "category": "external", "summary": "RHBZ#1661608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1661608" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5818", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5818" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5818", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5818" } ], "release_date": "2018-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp" }, { "cve": "CVE-2018-5819", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-12-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1661604" } ], "notes": [ { "category": "description", "text": "An error within the \"parse_sinar_ia()\" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.", "title": "Vulnerability description" }, { "category": "summary", "text": "LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5819" }, { "category": "external", "summary": "RHBZ#1661604", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1661604" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5819", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5819" } ], "release_date": "2018-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp" }, { "cve": "CVE-2018-12404", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-12-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1657913" } ], "notes": [ { "category": "description", "text": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.", "title": "Vulnerability description" }, { "category": "summary", "text": "nss: Cache side-channel variant of the Bleichenbacher attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-12404" }, { "category": "external", "summary": "RHBZ#1657913", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1657913" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12404", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12404" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12404", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12404" } ], "release_date": "2018-11-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nss: Cache side-channel variant of the Bleichenbacher attack" }, { "cve": "CVE-2018-12641", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-06-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1594410" } ], "notes": [ { "category": "description", "text": "An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg, demangle_args, and demangle_nested_args. This can occur during execution of nm-new.", "title": "Vulnerability description" }, { "category": "summary", "text": "binutils: Stack Exhaustion in the demangling functions provided by libiberty", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-12641" }, { "category": "external", "summary": "RHBZ#1594410", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1594410" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12641", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12641" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12641", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12641" } ], "release_date": "2018-04-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "binutils: Stack Exhaustion in the demangling functions provided by libiberty" }, { "cve": "CVE-2018-12697", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2018-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1595417" } ], "notes": [ { "category": "description", "text": "A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.", "title": "Vulnerability description" }, { "category": "summary", "text": "binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c.", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-12697" }, { "category": "external", "summary": "RHBZ#1595417", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595417" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12697", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12697" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12697", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12697" } ], "release_date": "2018-04-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c." }, { "acknowledgments": [ { "names": [ "the Curl project" ] }, { "names": [ "Zhaoyang Wu" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2018-14618", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2018-08-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1622707" } ], "notes": [ { "category": "description", "text": "curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)", "title": "Vulnerability description" }, { "category": "summary", "text": "curl: NTLM password overflow via integer overflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14618" }, { "category": "external", "summary": "RHBZ#1622707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1622707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14618", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14618" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14618", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14618" }, { "category": "external", "summary": "https://curl.haxx.se/docs/CVE-2018-14618.html", "url": "https://curl.haxx.se/docs/CVE-2018-14618.html" } ], "release_date": "2018-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "curl: NTLM password overflow via integer overflow" }, { "acknowledgments": [ { "names": [ "the Python Security Response Team" ] } ], "cve": "CVE-2018-14647", "cwe": { "id": "CWE-335", "name": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)" }, "discovery_date": "2018-09-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1631822" } ], "notes": [ { "category": "description", "text": "Python\u0027s elementtree C accelerator failed to initialise Expat\u0027s hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat\u0027s internal data structures, consuming large amounts CPU and RAM.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: Missing salt initialization in _elementtree.c module", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14647" }, { "category": "external", "summary": "RHBZ#1631822", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1631822" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14647", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14647" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14647", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14647" }, { "category": "external", "summary": "https://bugs.python.org/issue34623", "url": "https://bugs.python.org/issue34623" } ], "release_date": "2018-09-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: Missing salt initialization in _elementtree.c module" }, { "acknowledgments": [ { "names": [ "Jann Horn" ], "organization": "Google Project Zero" }, { "names": [ "Ubuntu" ] } ], "cve": "CVE-2018-15686", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2018-10-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1639071" } ], "notes": [ { "category": "description", "text": "It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service. Properties longer than LINE_MAX are not correctly parsed and an attacker may abuse this flaw in particularly configured services to inject, change, or corrupt the service state.", "title": "Vulnerability description" }, { "category": "summary", "text": "systemd: line splitting via fgets() allows for state injection during daemon-reexec", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-15686" }, { "category": "external", "summary": "RHBZ#1639071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1639071" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-15686", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15686" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-15686", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15686" } ], "release_date": "2018-10-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "systemd: line splitting via fgets() allows for state injection during daemon-reexec" }, { "cve": "CVE-2018-16062", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-08-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1623752" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read was discovered in elfutils in the way it reads DWARF address ranges information. Function dwarf_getaranges() in dwarf_getaranges.c does not properly check whether it reads beyond the limits of the ELF section. An attacker could use this flaw to cause a denial of service via a crafted file.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16062" }, { "category": "external", "summary": "RHBZ#1623752", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1623752" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16062", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16062" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16062", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16062" } ], "release_date": "2018-08-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file" }, { "cve": "CVE-2018-16402", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1625050" } ], "notes": [ { "category": "description", "text": "libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Double-free due to double decompression of sections in crafted ELF causes crash", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16402" }, { "category": "external", "summary": "RHBZ#1625050", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1625050" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16402", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16402" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16402", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16402" } ], "release_date": "2018-08-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Double-free due to double decompression of sections in crafted ELF causes crash" }, { "cve": "CVE-2018-16403", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1625055" } ], "notes": [ { "category": "description", "text": "libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16403" }, { "category": "external", "summary": "RHBZ#1625055", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1625055" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16403", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16403" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16403", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16403" } ], "release_date": "2018-08-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash" }, { "acknowledgments": [ { "names": [ "the Curl project" ] }, { "names": [ "Brian Carpenter" ], "organization": "Geeknik Labs", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2018-16842", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644124" } ], "notes": [ { "category": "description", "text": "Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "curl: Heap-based buffer over-read in the curl tool warning formatting", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16842" }, { "category": "external", "summary": "RHBZ#1644124", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644124" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16842", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16842" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16842", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16842" }, { "category": "external", "summary": "https://curl.haxx.se/docs/CVE-2018-16842.html", "url": "https://curl.haxx.se/docs/CVE-2018-16842.html" } ], "release_date": "2018-10-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "curl: Heap-based buffer over-read in the curl tool warning formatting" }, { "acknowledgments": [ { "names": [ "Qualys Research Labs" ] } ], "cve": "CVE-2018-16866", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1653867" } ], "notes": [ { "category": "description", "text": "An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon \u0027:\u0027. A local attacker can use this flaw to disclose process memory data.", "title": "Vulnerability description" }, { "category": "summary", "text": "systemd: out-of-bounds read when parsing a crafted syslog message", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of systemd as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having a security impact of Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.\n\nRed Hat Virtualization Hypervisor and Management Appliance include vulnerable versions of systemd. However, since exploitation requires local access and impact is restricted to information disclosure, this flaw is rated as having a security issue of Low. Future updates may address this issue.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16866" }, { "category": "external", "summary": "RHBZ#1653867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1653867" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16866", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16866" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16866", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16866" }, { "category": "external", "summary": "https://www.qualys.com/2019/01/09/system-down/system-down.txt", "url": "https://www.qualys.com/2019/01/09/system-down/system-down.txt" } ], "release_date": "2019-01-09T18:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "systemd: out-of-bounds read when parsing a crafted syslog message" }, { "cve": "CVE-2018-16888", "cwe": { "id": "CWE-250", "name": "Execution with Unnecessary Privileges" }, "discovery_date": "2019-01-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1662867" } ], "notes": [ { "category": "description", "text": "It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes.", "title": "Vulnerability description" }, { "category": "summary", "text": "systemd: kills privileged process if unprivileged PIDFile was tampered", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16888" }, { "category": "external", "summary": "RHBZ#1662867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1662867" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16888", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16888" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16888", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16888" } ], "release_date": "2017-08-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "systemd: kills privileged process if unprivileged PIDFile was tampered" }, { "cve": "CVE-2018-18310", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-10-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1642604" } ], "notes": [ { "category": "description", "text": "An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of elfutils as shipped with Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18310" }, { "category": "external", "summary": "RHBZ#1642604", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1642604" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18310", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18310" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18310", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18310" } ], "release_date": "2018-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl" }, { "cve": "CVE-2018-18520", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2018-10-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1646477" } ], "notes": [ { "category": "description", "text": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: eu-size cannot handle recursive ar files", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of elfutils as shipped with Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18520" }, { "category": "external", "summary": "RHBZ#1646477", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646477" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18520", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18520" } ], "release_date": "2018-10-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: eu-size cannot handle recursive ar files" }, { "cve": "CVE-2018-18521", "cwe": { "id": "CWE-369", "name": "Divide By Zero" }, "discovery_date": "2018-10-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1646482" } ], "notes": [ { "category": "description", "text": "Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of elfutils as shipped with Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18521" }, { "category": "external", "summary": "RHBZ#1646482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646482" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18521", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18521" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18521", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18521" } ], "release_date": "2018-10-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c" }, { "cve": "CVE-2018-20217", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "discovery_date": "2018-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1665296" } ], "notes": [ { "category": "description", "text": "A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.", "title": "Vulnerability description" }, { "category": "summary", "text": "krb5: Reachable assertion in the KDC using S4U2Self requests", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-20217" }, { "category": "external", "summary": "RHBZ#1665296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1665296" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-20217", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-20217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20217" } ], "release_date": "2018-12-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "krb5: Reachable assertion in the KDC using S4U2Self requests" }, { "cve": "CVE-2018-1000876", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2018-12-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1664699" } ], "notes": [ { "category": "description", "text": "binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.", "title": "Vulnerability description" }, { "category": "summary", "text": "binutils: integer overflow leads to heap-based buffer overflow in objdump", "title": "Vulnerability summary" }, { "category": "other", "text": "The issue is classified as moderate severity primarily because of the unlikelihood of running a 32bit compiled objdump and/or having a compiled binary that uses 32bit compiled binutils libraries to analyze binaries from a not trusted source. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security. \n\nAs per upstream binutils security policy this issue is not considered as a security flaw. Basically the key element of the policy that affects this is the understanding that analysis of untrusted binaries must always be done in a sandbox because the ELF format is open ended enough to make the analysis tools do anything, like including and processing arbitrary files. This eliminates the only possible vulnerability vector here, which is the possibility of a user being tricked into downloading and analyzing an untrusted ELF without sandboxing.\n\nSee the binutils security policy for more details:\nhttps://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-1000876" }, { "category": "external", "summary": "RHBZ#1664699", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1664699" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1000876", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000876" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000876", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000876" } ], "release_date": "2018-12-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "binutils: integer overflow leads to heap-based buffer overflow in objdump" }, { "cve": "CVE-2019-1559", "cwe": { "id": "CWE-325", "name": "Missing Cryptographic Step" }, "discovery_date": "2019-02-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1683804" } ], "notes": [ { "category": "description", "text": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: 0-byte record padding oracle", "title": "Vulnerability summary" }, { "category": "other", "text": "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1559" }, { "category": "external", "summary": "RHBZ#1683804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1559", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1559" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559" }, { "category": "external", "summary": "https://github.com/RUB-NDS/TLS-Padding-Oracles", "url": "https://github.com/RUB-NDS/TLS-Padding-Oracles" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20190226.txt", "url": "https://www.openssl.org/news/secadv/20190226.txt" } ], "release_date": "2019-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: 0-byte record padding oracle" }, { "acknowledgments": [ { "names": [ "the libssh2 project" ] }, { "names": [ "Chris Coulson" ], "organization": "Canonical Ltd.", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-3858", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-03-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1687306" } ], "notes": [ { "category": "description", "text": "An out of bounds read flaw was discovered in libssh2 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.\n\nlibssh2 is no longer included in the virt module since Red Hat Enterprise Linux 8.1.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-3858" }, { "category": "external", "summary": "RHBZ#1687306", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687306" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3858", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3858" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3858", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3858" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3858.html", "url": "https://www.libssh2.org/CVE-2019-3858.html" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read" }, { "acknowledgments": [ { "names": [ "the libssh2 project" ] }, { "names": [ "Chris Coulson" ], "organization": "Canonical Ltd.", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-3861", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-03-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1687311" } ], "notes": [ { "category": "description", "text": "An out of bounds read flaw was discovered in libssh2 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh2: Out-of-bounds reads with specially crafted SSH packets", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.\n\nlibssh2 is no longer included in the virt module since Red Hat Enterprise Linux 8.1.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-3861" }, { "category": "external", "summary": "RHBZ#1687311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687311" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3861", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3861" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3861", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3861" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3861.html", "url": "https://www.libssh2.org/CVE-2019-3861.html" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libssh2: Out-of-bounds reads with specially crafted SSH packets" }, { "acknowledgments": [ { "names": [ "the libssh2 project" ] }, { "names": [ "Chris Coulson" ], "organization": "Canonical Ltd.", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-3862", "cwe": { "id": "CWE-130", "name": "Improper Handling of Length Parameter Inconsistency" }, "discovery_date": "2019-03-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1687312" } ], "notes": [ { "category": "description", "text": "An out of bounds read flaw was discovered in libssh2 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh2: Out-of-bounds memory comparison with specially crafted message channel request", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.\n\nlibssh2 is no longer included in the virt module since Red Hat Enterprise Linux 8.1.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-3862" }, { "category": "external", "summary": "RHBZ#1687312", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687312" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3862", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3862" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3862", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3862" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3862.html", "url": "https://www.libssh2.org/CVE-2019-3862.html" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libssh2: Out-of-bounds memory comparison with specially crafted message channel request" }, { "cve": "CVE-2019-5010", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2019-01-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1666519" } ], "notes": [ { "category": "description", "text": "A null pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: NULL pointer dereference using a specially crafted X509 certificate", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue did not affect the versions of python as shipped with Red Hat Enterprise Linux 5 and 6.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5010" }, { "category": "external", "summary": "RHBZ#1666519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666519" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5010", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5010" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5010", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5010" }, { "category": "external", "summary": "https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html", "url": "https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html" } ], "release_date": "2019-01-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: NULL pointer dereference using a specially crafted X509 certificate" }, { "cve": "CVE-2019-7149", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-01-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1671443" } ], "notes": [ { "category": "description", "text": "A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7149" }, { "category": "external", "summary": "RHBZ#1671443", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671443" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7149", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7149" } ], "release_date": "2019-01-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw" }, { "cve": "CVE-2019-7150", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-01-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1671446" } ], "notes": [ { "category": "description", "text": "An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7150" }, { "category": "external", "summary": "RHBZ#1671446", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671446" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7150", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7150" } ], "release_date": "2018-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c" }, { "cve": "CVE-2019-7664", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2019-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1677536" } ], "notes": [ { "category": "description", "text": "In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7664" }, { "category": "external", "summary": "RHBZ#1677536", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677536" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7664", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7664" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7664", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7664" } ], "release_date": "2019-01-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h" }, { "cve": "CVE-2019-7665", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2019-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1677538" } ], "notes": [ { "category": "description", "text": "In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7665" }, { "category": "external", "summary": "RHBZ#1677538", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677538" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7665", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7665" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7665", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7665" } ], "release_date": "2019-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c" }, { "cve": "CVE-2019-9740", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688169" } ], "notes": [ { "category": "description", "text": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: CRLF injection via the query part of the url passed to urlopen()", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects:\n* All current versions of Red Hat OpenStack Platform. However, version 8 is due to retire on the 20th of April 2019, there are no more planned releases prior to this date.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9740" }, { "category": "external", "summary": "RHBZ#1688169", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688169" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9740", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9740" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9740", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9740" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: CRLF injection via the query part of the url passed to urlopen()" }, { "cve": "CVE-2019-9947", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695572" } ], "notes": [ { "category": "description", "text": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: CRLF injection via the path part of the url passed to urlopen()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9947" }, { "category": "external", "summary": "RHBZ#1695572", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695572" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9947", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9947" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9947", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9947" } ], "release_date": "2019-03-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: CRLF injection via the path part of the url passed to urlopen()" }, { "cve": "CVE-2019-9948", "cwe": { "id": "CWE-749", "name": "Exposed Dangerous Method or Function" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695570" } ], "notes": [ { "category": "description", "text": "urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen(\u0027local_file:///etc/passwd\u0027) call.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9948" }, { "category": "external", "summary": "RHBZ#1695570", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695570" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9948", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9948" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9948", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9948" } ], "release_date": "2019-03-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "If your application uses a blacklist to prevent \"file://\" schema from being used, consider using a whitelist approach to just allow the schemas you want or add \"local_file://\" schema to your blacklist.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Jonas Allmann" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11729", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-07-10T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1728437" } ], "notes": [ { "category": "description", "text": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.", "title": "Vulnerability description" }, { "category": "summary", "text": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault", "title": "Vulnerability summary" }, { "category": "other", "text": "Firefox on Red Hat Enterprise Linux is built against the system nss library.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11729" }, { "category": "external", "summary": "RHBZ#1728437", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728437" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11729", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11729" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11729", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11729" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729" } ], "release_date": "2019-07-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault" }, { "acknowledgments": [ { "names": [ "the Mozilla Project" ] } ], "cve": "CVE-2019-11745", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2019-11-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1774831" } ], "notes": [ { "category": "description", "text": "A heap-based buffer overflow was found in the NSC_EncryptUpdate() function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or decrypt operations, to execute arbitrary code with the permissions of the user running the application (compiled with nss). While the attack complexity is high, the impact to confidentiality, integrity, and availability are high as well.", "title": "Vulnerability description" }, { "category": "summary", "text": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate", "title": "Vulnerability summary" }, { "category": "other", "text": "Firefox and Thunderbird on Red Hat Enterprise Linux are built against the system nss library.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11745" }, { "category": "external", "summary": "RHBZ#1774831", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1774831" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11745", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11745" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11745", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11745" }, { "category": "external", "summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes", "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes" }, { "category": "external", "summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes", "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes" } ], "release_date": "2019-11-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate" }, { "cve": "CVE-2019-13734", "discovery_date": "2019-12-10T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1781980" } ], "notes": [ { "category": "description", "text": "Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "sqlite: fts3: improve shadow table corruption detection", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-13734" }, { "category": "external", "summary": "RHBZ#1781980", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1781980" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-13734", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-13734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13734" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html" } ], "release_date": "2019-12-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "sqlite: fts3: improve shadow table corruption detection" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1734", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)" }, "discovery_date": "2019-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1801804" } ], "notes": [ { "category": "description", "text": "A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: shell enabled by default in a pipe lookup plugin subprocess", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1734" }, { "category": "external", "summary": "RHBZ#1801804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801804" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1734", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1734" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "This issue can be avoided by escaping variables which are used in the lookup.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ansible: shell enabled by default in a pipe lookup plugin subprocess" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1735", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802085" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: path injection on dest parameter in fetch module", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1735" }, { "category": "external", "summary": "RHBZ#1802085", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802085" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1735", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1735" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except avoid using the affected fetch module when possible.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ansible: path injection on dest parameter in fetch module" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1736", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802124" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This issue affects only the newly created files and not existing ones. If the file already exists at the final destination, those permissions are retained. This could lead to the disclosure of sensitive data.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: atomic_move primitive sets permissive permissions", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.8.14 and 2.9.12 as well as previous versions and all 2.7.x versions are affected.\n\nAnsible Tower 3.6.5 and 3.7.2 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1736" }, { "category": "external", "summary": "RHBZ#1802124", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802124" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1736", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1736" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1736", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1736" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "This issue can be mitigated by specifying the \"mode\" on the task. That just leaves a race condition in place where newly created files that specify a mode in the task briefly go from 666 - umask to the final mode. An alternative workaround if many new files are created and to avoid setting a specific mode for each file would be to set the \"mode\" to \"preserve\" value. That will maintain the permissions of the source file on the controller in the final file on the managed host.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: atomic_move primitive sets permissive permissions" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1737", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2020-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802154" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: Extract-Zip function in win_unzip module does not check extracted path", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1737" }, { "category": "external", "summary": "RHBZ#1802154", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802154" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1737", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1737" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except avoid using the affected win_unzip module when possible.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ansible: Extract-Zip function in win_unzip module does not check extracted path" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1738", "cwe": { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802164" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine when the module package or service is used and the parameter \u0027use\u0027 is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: module package can be selected by the ansible facts", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1738" }, { "category": "external", "summary": "RHBZ#1802164", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802164" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1738", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1738" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1738", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1738" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Specify the parameter \u0027use\u0027 when possible on the package and service modules. Avoid using Ansible Collections on Ansible 2.8.9 or 2.7.16 (and any of the previous versions) as they are not rejecting python with no path (already fixed in 2.9.x).", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: module package can be selected by the ansible facts" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1739", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802178" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine. When a password is set with the argument \"password\" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: svn module leaks password when specified as a parameter", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1739" }, { "category": "external", "summary": "RHBZ#1802178", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802178" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1739", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1739" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1739", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1739" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Instead of using the parameter \u0027password\u0027 of the subversion module, provide the password with stdin.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: svn module leaks password when specified as a parameter" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1740", "cwe": { "id": "CWE-377", "name": "Insecure Temporary File" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802193" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes \"ansible-vault edit\", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: secrets readable after ansible-vault edit", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1740" }, { "category": "external", "summary": "RHBZ#1802193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802193" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1740", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1740" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1740", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1740" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except avoid using the \u0027edit\u0027 option from \u0027ansible-vault\u0027 command line tool.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: secrets readable after ansible-vault edit" }, { "acknowledgments": [ { "names": [ "Felix Fountein" ] } ], "cve": "CVE-2020-1746", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2019-12-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1805491" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: Information disclosure issue in ldap_attr and ldap_entry modules", "title": "Vulnerability summary" }, { "category": "other", "text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\n* Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be provided from core Ansible. But we still ship ansible separately for ceph ubuntu.\n\n* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1746" }, { "category": "external", "summary": "RHBZ#1805491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805491" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1746", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1746" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1746", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1746" } ], "release_date": "2020-02-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Using args keyword and embedding the ldap_auth variable instead of using bind_pw parameter would mitigate this issue.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: Information disclosure issue in ldap_attr and ldap_entry modules" }, { "acknowledgments": [ { "names": [ "Abhijeet Kasurde" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-1753", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2020-03-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1811008" } ], "notes": [ { "category": "description", "text": "A security flaw was found in the Ansible Engine when managing Kubernetes using the k8s connection plugin. Sensitive parameters such as passwords and tokens are passed to the kubectl command line instead of using environment variables or an input configuration file, which is safer. This flaw discloses passwords and tokens from the process list, and the no_log directive from the debug module would not be reflected in the underlying command-line tools options, displaying passwords and tokens on stdout and log files.", "title": "Vulnerability description" }, { "category": "summary", "text": "Ansible: kubectl connection plugin leaks sensitive information", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.17, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1753" }, { "category": "external", "summary": "RHBZ#1811008", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811008" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1753", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1753" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1753", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1753" } ], "release_date": "2020-03-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Ansible: kubectl connection plugin leaks sensitive information" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-10684", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1815519" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine. When using ansible_facts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansible_facts after the clean, an attacker could take advantage of this by altering the ansible_facts leading to privilege escalation or code injection. The highest threat from this vulnerability are to data integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "Ansible: code injection when using ansible_facts as a subkey", "title": "Vulnerability summary" }, { "category": "other", "text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n* Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be consumed from core Ansible. But we still ship ansible separately for ceph ubuntu.\n* Red Hat OpenStack Platform does package the affected code. However, because RHOSP does not use ansible_facts as a subkey directly, the RHOSP impact has been reduced to Moderate and no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10684" }, { "category": "external", "summary": "RHBZ#1815519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815519" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10684", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10684" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10684", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10684" } ], "release_date": "2020-03-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is not a known mitigation except avoiding the functionality of using ansible_facts as a subkey.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Ansible: code injection when using ansible_facts as a subkey" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-10685", "cwe": { "id": "CWE-459", "name": "Incomplete Cleanup" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1814627" } ], "notes": [ { "category": "description", "text": "A flaw was found on Ansible Engine when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the secrets unencrypted.\r\n\r\nOn Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decrypted data remains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted is sensible.", "title": "Vulnerability description" }, { "category": "summary", "text": "Ansible: modules which use files encrypted with vault are not properly cleaned up", "title": "Vulnerability summary" }, { "category": "other", "text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\n* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10685" }, { "category": "external", "summary": "RHBZ#1814627", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814627" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10685", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10685" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685" } ], "release_date": "2020-03-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except by removing manually the temporary created file after every run.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Ansible: modules which use files encrypted with vault are not properly cleaned up" } ] }
rhsa-2019_3932
Vulnerability from csaf_redhat
Published
2019-11-20 16:22
Modified
2025-01-05 19:06
Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6
Notes
Topic
Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3932", "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "JBCS-798", "url": "https://issues.redhat.com/browse/JBCS-798" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3932.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6", "tracking": { "current_release_date": "2025-01-05T19:06:29+00:00", "generator": { "date": "2025-01-05T19:06:29+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.5" } }, "id": "RHSA-2019:3932", "initial_release_date": "2019-11-20T16:22:09+00:00", "revision_history": [ { "date": "2019-11-20T16:22:09+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-01-06T13:05:52+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-01-05T19:06:29+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Core Services on RHEL 6 Server", "product": { "name": "Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1::el6" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "product_id": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-devel@2.11-20.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "product_id": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-debuginfo@2.11-20.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-63.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-63.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-devel@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-ldap@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-mysql@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-nss@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-odbc@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-openssl@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-pgsql@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-sqlite@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-debuginfo@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-7.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-7.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "product_id": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-devel@1.39.2-4.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "product_id": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-debuginfo@1.39.2-4.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl-devel@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl-debuginfo@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-33.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-33.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-9.Final_redhat_2.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.46-22.redhat_1.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-manual@1.2.46-22.redhat_1.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-debuginfo@1.2.46-22.redhat_1.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.2-16.GA.jbcs.el6?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-devel@2.11-20.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-debuginfo@2.11-20.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-63.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-63.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-devel@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-ldap@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-mysql@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-nss@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-odbc@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-openssl@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-pgsql@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-sqlite@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-debuginfo@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-7.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-7.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-devel@1.39.2-4.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-debuginfo@1.39.2-4.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl-devel@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl-debuginfo@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-33.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-33.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-9.Final_redhat_2.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.46-22.redhat_1.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-manual@1.2.46-22.redhat_1.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-debuginfo@1.2.46-22.redhat_1.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.2-16.GA.jbcs.el6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el6?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk@1.2.46-22.redhat_1.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "product": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "product_id": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.37-33.jbcs.el6?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch" }, "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0737", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568253" } ], "notes": [ { "category": "description", "text": "OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0737" }, { "category": "external", "summary": "RHBZ#1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2018/04/16/3", "url": "http://www.openwall.com/lists/oss-security/2018/04/16/3" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20180416.txt", "url": "https://www.openssl.org/news/secadv/20180416.txt" } ], "release_date": "2018-04-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys" }, { "acknowledgments": [ { "names": [ "Alejandro Cabrera Aldaya" ], "organization": "Universidad Tecnologica de la Habana CUJAE; Cuba" }, { "names": [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan" ] }, { "names": [ "Nicola Tuveri" ], "organization": "Tampere University of Technology; Finland" } ], "cve": "CVE-2018-5407", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1645695" } ], "notes": [ { "category": "description", "text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", "title": "Vulnerability summary" }, { "category": "other", "text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5407" }, { "category": "external", "summary": "RHBZ#1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407" }, { "category": "external", "summary": "https://github.com/bbbrumley/portsmash", "url": "https://github.com/bbbrumley/portsmash" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20181112.txt", "url": "https://www.openssl.org/news/secadv/20181112.txt" } ], "release_date": "2018-10-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)" }, { "cve": "CVE-2018-17189", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668497" } ], "notes": [ { "category": "description", "text": "In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: DoS via slow, unneeded request bodies", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17189" }, { "category": "external", "summary": "RHBZ#1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17189", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17189" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: DoS via slow, unneeded request bodies" }, { "cve": "CVE-2018-17199", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668493" } ], "notes": [ { "category": "description", "text": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_session_cookie does not respect expiry time", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17199" }, { "category": "external", "summary": "RHBZ#1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17199", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17199" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_session_cookie does not respect expiry time" }, { "cve": "CVE-2019-0196", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695030" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: read-after-free on a string compare", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0196" }, { "category": "external", "summary": "RHBZ#1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0196", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0196" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: read-after-free on a string compare" }, { "cve": "CVE-2019-0197", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695042" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: possible crash on late upgrade", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0197" }, { "category": "external", "summary": "RHBZ#1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0197", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0197" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-02-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: possible crash on late upgrade" }, { "cve": "CVE-2019-0217", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695020" } ], "notes": [ { "category": "description", "text": "A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_auth_digest: access control bypass due to race condition", "title": "Vulnerability summary" }, { "category": "other", "text": "Based on the the fact that digest authentication is rarely used in modern day web applications and httpd package shipped with Red Hat products do not ship threaded MPM configuration by default, this flaw has been rated as having Moderate level security impact. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0217" }, { "category": "external", "summary": "RHBZ#1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0217", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "This flaw only affects a threaded server configuration, so using the prefork MPM is an effective mitigation. In versions of httpd package shipped with Red Hat Enterprise Linux 7, the prefork MPM is the default configuration.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_auth_digest: access control bypass due to race condition" }, { "cve": "CVE-2019-9511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741860" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: large amount of data requests leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "There are no mitigations available for nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9511" }, { "category": "external", "summary": "RHBZ#1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9511", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: large amount of data requests leads to denial of service" }, { "acknowledgments": [ { "names": [ "the Envoy security team" ] } ], "cve": "CVE-2019-9513", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1735741" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for packages nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9513" }, { "category": "external", "summary": "RHBZ#1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9513", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9513" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/", "url": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption" }, { "cve": "CVE-2019-9516", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741864" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: 0-length headers lead to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9516" }, { "category": "external", "summary": "RHBZ#1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9516", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9516" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://github.com/nghttp2/nghttp2/issues/1382#", "url": "https://github.com/nghttp2/nghttp2/issues/1382#" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: 0-length headers lead to denial of service" }, { "cve": "CVE-2019-9517", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741868" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server\u0027s queue is setup, the responses can consume excess memory, CPU, or both, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: request for large response leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "The package httpd versions as shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this issue as HTTP/2 support is not provided.\nThis flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9517" }, { "category": "external", "summary": "RHBZ#1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9517", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps:\n\n1. Stop httpd service:\n$ systemctl stop httpd\n\n2. Remove http/2 protocol support from configuration files:\n$ sed -i \u0027s/\\(h2\\)\\|\\(h2c\\)//g\u0027 \u003chttpd_config_file\u003e\n\n3. Validate configuration files to make sure all syntax is valid:\n$ apachectl configtest\n\n4. Restart httpd service:\n$ systemctl start httpd", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: request for large response leads to denial of service" } ] }
rhsa-2019:3935
Vulnerability from csaf_redhat
Published
2019-11-20 16:08
Modified
2025-07-09 04:58
Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release
Notes
Topic
Red Hat JBoss Core Services Pack Apache Server 2.4.37 zip release
for RHEL 6, RHEL 7 and Microsoft Windows is available.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.
This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat JBoss Core Services Pack Apache Server 2.4.37 zip release\nfor RHEL 6, RHEL 7 and Microsoft Windows is available.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.\n\nThis release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3935", "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "JBCS-798", "url": "https://issues.redhat.com/browse/JBCS-798" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3935.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release", "tracking": { "current_release_date": "2025-07-09T04:58:41+00:00", "generator": { "date": "2025-07-09T04:58:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2019:3935", "initial_release_date": "2019-11-20T16:08:18+00:00", "revision_history": [ { "date": "2019-11-20T16:08:18+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-01-06T13:01:52+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-09T04:58:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Text-Only JBCS", "product": { "name": "Text-Only JBCS", "product_id": "Text-Only JBCS", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0737", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568253" } ], "notes": [ { "category": "description", "text": "OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0737" }, { "category": "external", "summary": "RHBZ#1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2018/04/16/3", "url": "http://www.openwall.com/lists/oss-security/2018/04/16/3" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20180416.txt", "url": "https://www.openssl.org/news/secadv/20180416.txt" } ], "release_date": "2018-04-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys" }, { "acknowledgments": [ { "names": [ "Alejandro Cabrera Aldaya" ], "organization": "Universidad Tecnologica de la Habana CUJAE; Cuba" }, { "names": [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan" ] }, { "names": [ "Nicola Tuveri" ], "organization": "Tampere University of Technology; Finland" } ], "cve": "CVE-2018-5407", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1645695" } ], "notes": [ { "category": "description", "text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", "title": "Vulnerability summary" }, { "category": "other", "text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5407" }, { "category": "external", "summary": "RHBZ#1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407" }, { "category": "external", "summary": "https://github.com/bbbrumley/portsmash", "url": "https://github.com/bbbrumley/portsmash" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20181112.txt", "url": "https://www.openssl.org/news/secadv/20181112.txt" } ], "release_date": "2018-10-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)" }, { "cve": "CVE-2018-17189", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668497" } ], "notes": [ { "category": "description", "text": "In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: DoS via slow, unneeded request bodies", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17189" }, { "category": "external", "summary": "RHBZ#1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17189", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17189" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: DoS via slow, unneeded request bodies" }, { "cve": "CVE-2018-17199", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668493" } ], "notes": [ { "category": "description", "text": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_session_cookie does not respect expiry time", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17199" }, { "category": "external", "summary": "RHBZ#1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17199", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17199" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_session_cookie does not respect expiry time" }, { "cve": "CVE-2019-0196", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695030" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: read-after-free on a string compare", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0196" }, { "category": "external", "summary": "RHBZ#1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0196", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0196" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: read-after-free on a string compare" }, { "cve": "CVE-2019-0197", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695042" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: possible crash on late upgrade", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0197" }, { "category": "external", "summary": "RHBZ#1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0197", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0197" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-02-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: possible crash on late upgrade" }, { "cve": "CVE-2019-0217", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695020" } ], "notes": [ { "category": "description", "text": "A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_auth_digest: access control bypass due to race condition", "title": "Vulnerability summary" }, { "category": "other", "text": "Based on the the fact that digest authentication is rarely used in modern day web applications and httpd package shipped with Red Hat products do not ship threaded MPM configuration by default, this flaw has been rated as having Moderate level security impact. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0217" }, { "category": "external", "summary": "RHBZ#1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0217", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "This flaw only affects a threaded server configuration, so using the prefork MPM is an effective mitigation. In versions of httpd package shipped with Red Hat Enterprise Linux 7, the prefork MPM is the default configuration.", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_auth_digest: access control bypass due to race condition" }, { "cve": "CVE-2019-9511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741860" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: large amount of data requests leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "There are no mitigations available for nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9511" }, { "category": "external", "summary": "RHBZ#1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9511", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: large amount of data requests leads to denial of service" }, { "acknowledgments": [ { "names": [ "the Envoy security team" ] } ], "cve": "CVE-2019-9513", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1735741" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for packages nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9513" }, { "category": "external", "summary": "RHBZ#1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9513", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9513" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/", "url": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption" }, { "cve": "CVE-2019-9516", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741864" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: 0-length headers lead to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9516" }, { "category": "external", "summary": "RHBZ#1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9516", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9516" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://github.com/nghttp2/nghttp2/issues/1382#", "url": "https://github.com/nghttp2/nghttp2/issues/1382#" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: 0-length headers lead to denial of service" }, { "cve": "CVE-2019-9517", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741868" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server\u0027s queue is setup, the responses can consume excess memory, CPU, or both, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: request for large response leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "The package httpd versions as shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this issue as HTTP/2 support is not provided.\nThis flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9517" }, { "category": "external", "summary": "RHBZ#1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9517", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps:\n\n1. Stop httpd service:\n$ systemctl stop httpd\n\n2. Remove http/2 protocol support from configuration files:\n$ sed -i \u0027s/\\(h2\\)\\|\\(h2c\\)//g\u0027 \u003chttpd_config_file\u003e\n\n3. Validate configuration files to make sure all syntax is valid:\n$ apachectl configtest\n\n4. Restart httpd service:\n$ systemctl start httpd", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: request for large response leads to denial of service" } ] }
rhsa-2019_3933
Vulnerability from csaf_redhat
Published
2019-11-20 16:14
Modified
2025-01-05 19:06
Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7
Notes
Topic
An update is now available for JBoss Core Services on RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737)
* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)
* mod_auth_digest: access control bypass due to race condition (CVE-2019-0217)
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* mod_session_cookie does not respect expiry time (CVE-2018-17199)
* mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)
* mod_http2: possible crash on late upgrade (CVE-2019-0197)
* mod_http2: read-after-free on a string compare (CVE-2019-0196)
* nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)
* nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)
* mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)
* mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for JBoss Core Services on RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737)\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n* mod_auth_digest: access control bypass due to race condition (CVE-2019-0217)\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)\n* mod_session_cookie does not respect expiry time (CVE-2018-17199)\n* mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)\n* mod_http2: possible crash on late upgrade (CVE-2019-0197)\n* mod_http2: read-after-free on a string compare (CVE-2019-0196)\n* nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)\n* nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)\n* mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)\n* mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3933", "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "JBCS-798", "url": "https://issues.redhat.com/browse/JBCS-798" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3933.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7", "tracking": { "current_release_date": "2025-01-05T19:06:10+00:00", "generator": { "date": "2025-01-05T19:06:10+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.5" } }, "id": "RHSA-2019:3933", "initial_release_date": "2019-11-20T16:14:21+00:00", "revision_history": [ { "date": "2019-11-20T16:14:21+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-01-06T13:04:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-01-05T19:06:10+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Core Services on RHEL 7 Server", "product": { "name": "Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1::el7" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-devel@2.11-20.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-debuginfo@2.11-20.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-63.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-63.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-devel@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-ldap@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-mysql@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-nss@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-odbc@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-openssl@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-pgsql@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-sqlite@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-debuginfo@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-7.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-7.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-devel@1.39.2-4.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-debuginfo@1.39.2-4.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl-devel@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl-debuginfo@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-33.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-33.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.46-22.redhat_1.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-manual@1.2.46-22.redhat_1.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-debuginfo@1.2.46-22.redhat_1.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-9.Final_redhat_2.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.2-16.GA.jbcs.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el7?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk@1.2.46-22.redhat_1.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "product": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "product_id": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.37-33.jbcs.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch" }, "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0737", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568253" } ], "notes": [ { "category": "description", "text": "OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0737" }, { "category": "external", "summary": "RHBZ#1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2018/04/16/3", "url": "http://www.openwall.com/lists/oss-security/2018/04/16/3" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20180416.txt", "url": "https://www.openssl.org/news/secadv/20180416.txt" } ], "release_date": "2018-04-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys" }, { "acknowledgments": [ { "names": [ "Alejandro Cabrera Aldaya" ], "organization": "Universidad Tecnologica de la Habana CUJAE; Cuba" }, { "names": [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan" ] }, { "names": [ "Nicola Tuveri" ], "organization": "Tampere University of Technology; Finland" } ], "cve": "CVE-2018-5407", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1645695" } ], "notes": [ { "category": "description", "text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", "title": "Vulnerability summary" }, { "category": "other", "text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5407" }, { "category": "external", "summary": "RHBZ#1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407" }, { "category": "external", "summary": "https://github.com/bbbrumley/portsmash", "url": "https://github.com/bbbrumley/portsmash" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20181112.txt", "url": "https://www.openssl.org/news/secadv/20181112.txt" } ], "release_date": "2018-10-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)" }, { "cve": "CVE-2018-17189", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668497" } ], "notes": [ { "category": "description", "text": "In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: DoS via slow, unneeded request bodies", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17189" }, { "category": "external", "summary": "RHBZ#1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17189", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17189" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: DoS via slow, unneeded request bodies" }, { "cve": "CVE-2018-17199", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668493" } ], "notes": [ { "category": "description", "text": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_session_cookie does not respect expiry time", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17199" }, { "category": "external", "summary": "RHBZ#1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17199", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17199" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_session_cookie does not respect expiry time" }, { "cve": "CVE-2019-0196", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695030" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: read-after-free on a string compare", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0196" }, { "category": "external", "summary": "RHBZ#1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0196", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0196" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: read-after-free on a string compare" }, { "cve": "CVE-2019-0197", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695042" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: possible crash on late upgrade", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0197" }, { "category": "external", "summary": "RHBZ#1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0197", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0197" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-02-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: possible crash on late upgrade" }, { "cve": "CVE-2019-0217", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695020" } ], "notes": [ { "category": "description", "text": "A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_auth_digest: access control bypass due to race condition", "title": "Vulnerability summary" }, { "category": "other", "text": "Based on the the fact that digest authentication is rarely used in modern day web applications and httpd package shipped with Red Hat products do not ship threaded MPM configuration by default, this flaw has been rated as having Moderate level security impact. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0217" }, { "category": "external", "summary": "RHBZ#1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0217", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "This flaw only affects a threaded server configuration, so using the prefork MPM is an effective mitigation. In versions of httpd package shipped with Red Hat Enterprise Linux 7, the prefork MPM is the default configuration.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_auth_digest: access control bypass due to race condition" }, { "cve": "CVE-2019-9511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741860" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: large amount of data requests leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "There are no mitigations available for nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9511" }, { "category": "external", "summary": "RHBZ#1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9511", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: large amount of data requests leads to denial of service" }, { "acknowledgments": [ { "names": [ "the Envoy security team" ] } ], "cve": "CVE-2019-9513", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1735741" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for packages nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9513" }, { "category": "external", "summary": "RHBZ#1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9513", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9513" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/", "url": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption" }, { "cve": "CVE-2019-9516", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741864" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: 0-length headers lead to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9516" }, { "category": "external", "summary": "RHBZ#1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9516", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9516" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://github.com/nghttp2/nghttp2/issues/1382#", "url": "https://github.com/nghttp2/nghttp2/issues/1382#" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: 0-length headers lead to denial of service" }, { "cve": "CVE-2019-9517", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741868" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server\u0027s queue is setup, the responses can consume excess memory, CPU, or both, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: request for large response leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "The package httpd versions as shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this issue as HTTP/2 support is not provided.\nThis flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9517" }, { "category": "external", "summary": "RHBZ#1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9517", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps:\n\n1. Stop httpd service:\n$ systemctl stop httpd\n\n2. Remove http/2 protocol support from configuration files:\n$ sed -i \u0027s/\\(h2\\)\\|\\(h2c\\)//g\u0027 \u003chttpd_config_file\u003e\n\n3. Validate configuration files to make sure all syntax is valid:\n$ apachectl configtest\n\n4. Restart httpd service:\n$ systemctl start httpd", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: request for large response leads to denial of service" } ] }
rhsa-2019:2304
Vulnerability from csaf_redhat
Published
2019-08-06 13:42
Modified
2025-03-15 19:41
Summary
Red Hat Security Advisory: openssl security and bug fix update
Notes
Topic
An update for openssl is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
Security Fix(es):
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openssl is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: 0-byte record padding oracle (CVE-2019-1559)\n\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:2304", "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1649568", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1649568" }, { "category": "external", "summary": "1683804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2304.json" } ], "title": "Red Hat Security Advisory: openssl security and bug fix update", "tracking": { "current_release_date": "2025-03-15T19:41:25+00:00", "generator": { "date": "2025-03-15T19:41:25+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.4.1" } }, "id": "RHSA-2019:2304", "initial_release_date": "2019-08-06T13:42:09+00:00", "revision_history": [ { "date": "2019-08-06T13:42:09+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-08-06T13:42:09+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-03-15T19:41:25+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ComputeNode (v. 7)", "product": { "name": "Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-perl-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-static-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-devel-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-libs-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-static-1:1.0.2k-19.el7.i686", "product_id": "openssl-static-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.i686", "product_id": "openssl-devel-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.i686", "product_id": "openssl-libs-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.src", "product": { "name": "openssl-1:1.0.2k-19.el7.src", "product_id": "openssl-1:1.0.2k-19.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x", "product_id": "openssl-perl-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-static-1:1.0.2k-19.el7.s390x", "product_id": "openssl-static-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-1:1.0.2k-19.el7.s390x", "product_id": "openssl-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x", "product_id": "openssl-devel-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x", "product_id": "openssl-libs-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-static-1:1.0.2k-19.el7.s390", "product_id": "openssl-static-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.s390", "product_id": "openssl-devel-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.s390", "product_id": "openssl-libs-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } } ], "category": "architecture", "name": "s390" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-perl-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-static-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-devel-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-libs-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-static-1:1.0.2k-19.el7.ppc", "product_id": "openssl-static-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc", "product_id": "openssl-devel-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc", "product_id": "openssl-libs-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-static-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T13:42:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2304" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2019-1559", "cwe": { "id": "CWE-325", "name": "Missing Cryptographic Step" }, "discovery_date": "2019-02-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1683804" } ], "notes": [ { "category": "description", "text": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: 0-byte record padding oracle", "title": "Vulnerability summary" }, { "category": "other", "text": "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1559" }, { "category": "external", "summary": "RHBZ#1683804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1559", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1559" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559" }, { "category": "external", "summary": "https://github.com/RUB-NDS/TLS-Padding-Oracles", "url": "https://github.com/RUB-NDS/TLS-Padding-Oracles" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20190226.txt", "url": "https://www.openssl.org/news/secadv/20190226.txt" } ], "release_date": "2019-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T13:42:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "workaround", "details": "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", "product_ids": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: 0-byte record padding oracle" } ] }
rhsa-2019:3933
Vulnerability from csaf_redhat
Published
2019-11-20 16:14
Modified
2025-07-09 04:58
Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7
Notes
Topic
An update is now available for JBoss Core Services on RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737)
* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)
* mod_auth_digest: access control bypass due to race condition (CVE-2019-0217)
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* mod_session_cookie does not respect expiry time (CVE-2018-17199)
* mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)
* mod_http2: possible crash on late upgrade (CVE-2019-0197)
* mod_http2: read-after-free on a string compare (CVE-2019-0196)
* nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)
* nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)
* mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)
* mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for JBoss Core Services on RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737)\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n* mod_auth_digest: access control bypass due to race condition (CVE-2019-0217)\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)\n* mod_session_cookie does not respect expiry time (CVE-2018-17199)\n* mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)\n* mod_http2: possible crash on late upgrade (CVE-2019-0197)\n* mod_http2: read-after-free on a string compare (CVE-2019-0196)\n* nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)\n* nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)\n* mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)\n* mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3933", "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "JBCS-798", "url": "https://issues.redhat.com/browse/JBCS-798" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3933.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7", "tracking": { "current_release_date": "2025-07-09T04:58:51+00:00", "generator": { "date": "2025-07-09T04:58:51+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2019:3933", "initial_release_date": "2019-11-20T16:14:21+00:00", "revision_history": [ { "date": "2019-11-20T16:14:21+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-01-06T13:04:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-09T04:58:51+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Core Services on RHEL 7 Server", "product": { "name": "Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1::el7" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-devel@2.11-20.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-debuginfo@2.11-20.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-63.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-63.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-devel@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-ldap@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-mysql@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-nss@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-odbc@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-openssl@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-pgsql@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-sqlite@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-debuginfo@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-7.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-7.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-devel@1.39.2-4.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-debuginfo@1.39.2-4.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl-devel@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl-debuginfo@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-33.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-33.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.46-22.redhat_1.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-manual@1.2.46-22.redhat_1.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-debuginfo@1.2.46-22.redhat_1.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-9.Final_redhat_2.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.2-16.GA.jbcs.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el7?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk@1.2.46-22.redhat_1.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "product": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "product_id": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.37-33.jbcs.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch" }, "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0737", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568253" } ], "notes": [ { "category": "description", "text": "OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0737" }, { "category": "external", "summary": "RHBZ#1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2018/04/16/3", "url": "http://www.openwall.com/lists/oss-security/2018/04/16/3" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20180416.txt", "url": "https://www.openssl.org/news/secadv/20180416.txt" } ], "release_date": "2018-04-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys" }, { "acknowledgments": [ { "names": [ "Alejandro Cabrera Aldaya" ], "organization": "Universidad Tecnologica de la Habana CUJAE; Cuba" }, { "names": [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan" ] }, { "names": [ "Nicola Tuveri" ], "organization": "Tampere University of Technology; Finland" } ], "cve": "CVE-2018-5407", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1645695" } ], "notes": [ { "category": "description", "text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", "title": "Vulnerability summary" }, { "category": "other", "text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5407" }, { "category": "external", "summary": "RHBZ#1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407" }, { "category": "external", "summary": "https://github.com/bbbrumley/portsmash", "url": "https://github.com/bbbrumley/portsmash" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20181112.txt", "url": "https://www.openssl.org/news/secadv/20181112.txt" } ], "release_date": "2018-10-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)" }, { "cve": "CVE-2018-17189", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668497" } ], "notes": [ { "category": "description", "text": "In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: DoS via slow, unneeded request bodies", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17189" }, { "category": "external", "summary": "RHBZ#1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17189", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17189" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: DoS via slow, unneeded request bodies" }, { "cve": "CVE-2018-17199", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668493" } ], "notes": [ { "category": "description", "text": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_session_cookie does not respect expiry time", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17199" }, { "category": "external", "summary": "RHBZ#1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17199", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17199" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_session_cookie does not respect expiry time" }, { "cve": "CVE-2019-0196", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695030" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: read-after-free on a string compare", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0196" }, { "category": "external", "summary": "RHBZ#1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0196", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0196" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: read-after-free on a string compare" }, { "cve": "CVE-2019-0197", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695042" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: possible crash on late upgrade", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0197" }, { "category": "external", "summary": "RHBZ#1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0197", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0197" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-02-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: possible crash on late upgrade" }, { "cve": "CVE-2019-0217", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695020" } ], "notes": [ { "category": "description", "text": "A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_auth_digest: access control bypass due to race condition", "title": "Vulnerability summary" }, { "category": "other", "text": "Based on the the fact that digest authentication is rarely used in modern day web applications and httpd package shipped with Red Hat products do not ship threaded MPM configuration by default, this flaw has been rated as having Moderate level security impact. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0217" }, { "category": "external", "summary": "RHBZ#1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0217", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "This flaw only affects a threaded server configuration, so using the prefork MPM is an effective mitigation. In versions of httpd package shipped with Red Hat Enterprise Linux 7, the prefork MPM is the default configuration.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_auth_digest: access control bypass due to race condition" }, { "cve": "CVE-2019-9511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741860" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: large amount of data requests leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "There are no mitigations available for nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9511" }, { "category": "external", "summary": "RHBZ#1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9511", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: large amount of data requests leads to denial of service" }, { "acknowledgments": [ { "names": [ "the Envoy security team" ] } ], "cve": "CVE-2019-9513", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1735741" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for packages nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9513" }, { "category": "external", "summary": "RHBZ#1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9513", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9513" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/", "url": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption" }, { "cve": "CVE-2019-9516", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741864" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: 0-length headers lead to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9516" }, { "category": "external", "summary": "RHBZ#1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9516", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9516" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://github.com/nghttp2/nghttp2/issues/1382#", "url": "https://github.com/nghttp2/nghttp2/issues/1382#" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: 0-length headers lead to denial of service" }, { "cve": "CVE-2019-9517", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741868" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server\u0027s queue is setup, the responses can consume excess memory, CPU, or both, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: request for large response leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "The package httpd versions as shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this issue as HTTP/2 support is not provided.\nThis flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9517" }, { "category": "external", "summary": "RHBZ#1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9517", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps:\n\n1. Stop httpd service:\n$ systemctl stop httpd\n\n2. Remove http/2 protocol support from configuration files:\n$ sed -i \u0027s/\\(h2\\)\\|\\(h2c\\)//g\u0027 \u003chttpd_config_file\u003e\n\n3. Validate configuration files to make sure all syntax is valid:\n$ apachectl configtest\n\n4. Restart httpd service:\n$ systemctl start httpd", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: request for large response leads to denial of service" } ] }
rhba-2020:0547
Vulnerability from csaf_redhat
Published
2020-02-18 15:13
Modified
2025-05-07 16:18
Summary
Red Hat Bug Fix Advisory: Container Image Rebuild for Ansible Tower 3.4 Dependency
Notes
Topic
Container Image Rebuild for Ansible Tower 3.4 Dependency
Details
The ansible-tower-memcached container image has been updated for Red Hat Ansible Tower 3.4 for RHEL 7 to address security advisories:
RHSA-2019:2030
RHSA-2019:2118
RHSA-2019:2136
RHSA-2019:2197
RHSA-2019:2237
RHSA-2019:2304
RHSA-2019:4190
RHSA-2020:0227
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Container Image Rebuild for Ansible Tower 3.4 Dependency", "title": "Topic" }, { "category": "general", "text": "The ansible-tower-memcached container image has been updated for Red Hat Ansible Tower 3.4 for RHEL 7 to address security advisories:\n\nRHSA-2019:2030\nRHSA-2019:2118\nRHSA-2019:2136\nRHSA-2019:2197\nRHSA-2019:2237\nRHSA-2019:2304\nRHSA-2019:4190\nRHSA-2020:0227", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHBA-2020:0547", "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2030", "url": "https://access.redhat.com/errata/RHSA-2019:2030" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2118", "url": "https://access.redhat.com/errata/RHSA-2019:2118" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2136", "url": "https://access.redhat.com/errata/RHSA-2019:2136" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2197", "url": "https://access.redhat.com/errata/RHSA-2019:2197" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2237", "url": "https://access.redhat.com/errata/RHSA-2019:2237" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2304", "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:4190", "url": "https://access.redhat.com/errata/RHSA-2019:4190" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2020:0227", "url": "https://access.redhat.com/errata/RHSA-2020:0227" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_0547.json" } ], "title": "Red Hat Bug Fix Advisory: Container Image Rebuild for Ansible Tower 3.4 Dependency", "tracking": { "current_release_date": "2025-05-07T16:18:49+00:00", "generator": { "date": "2025-05-07T16:18:49+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.5.0" } }, "id": "RHBA-2020:0547", "initial_release_date": "2020-02-18T15:13:57+00:00", "revision_history": [ { "date": "2020-02-18T15:13:57+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-02-18T15:13:57+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-05-07T16:18:49+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product": { "name": "Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:ansible_tower:3.4::el7" } } } ], "category": "product_family", "name": "Red Hat Ansible Tower" }, { "branches": [ { "category": "product_version", "name": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product": { "name": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_id": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_identification_helper": { "purl": "pkg:oci/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-37/ansible-tower-memcached-rhel7\u0026tag=1.4.15-28" } } }, { "category": "product_version", "name": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product": { "name": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_id": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_identification_helper": { "purl": "pkg:oci/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-35/ansible-tower-memcached\u0026tag=1.4.15-28" } } }, { "category": "product_version", "name": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product": { "name": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_id": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "product_identification_helper": { "purl": "pkg:oci/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-34/ansible-tower-memcached\u0026tag=1.4.15-28" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64 as a component of Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" }, "product_reference": "ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "relates_to_product_reference": "7Server-Ansible-Tower-3.4" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64 as a component of Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" }, "product_reference": "ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "relates_to_product_reference": "7Server-Ansible-Tower-3.4" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64 as a component of Red Hat Ansible Tower 3.4 for RHEL 7 Server", "product_id": "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" }, "product_reference": "ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "relates_to_product_reference": "7Server-Ansible-Tower-3.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2016-10739", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2016-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1347549" } ], "notes": [ { "category": "description", "text": "In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.", "title": "Vulnerability description" }, { "category": "summary", "text": "glibc: getaddrinfo should reject IP addresses with trailing characters", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-10739" }, { "category": "external", "summary": "RHBZ#1347549", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1347549" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-10739", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10739" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10739", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10739" } ], "release_date": "2016-04-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glibc: getaddrinfo should reject IP addresses with trailing characters" }, { "cve": "CVE-2018-0495", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-06-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1591163" } ], "notes": [ { "category": "description", "text": "Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.", "title": "Vulnerability description" }, { "category": "summary", "text": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries", "title": "Vulnerability summary" }, { "category": "other", "text": "Since the 5.8.3 release, Red Hat CloudForms no longer uses libtomcrypt.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0495" }, { "category": "external", "summary": "RHBZ#1591163", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1591163" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0495", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0495" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0495", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0495" }, { "category": "external", "summary": "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/", "url": "https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/" } ], "release_date": "2018-06-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries" }, { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "acknowledgments": [ { "names": [ "Qualys Research Labs" ] } ], "cve": "CVE-2018-1122", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2018-05-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1575466" } ], "notes": [ { "category": "description", "text": "If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.", "title": "Vulnerability description" }, { "category": "summary", "text": "procps: Local privilege escalation in top", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-1122" }, { "category": "external", "summary": "RHBZ#1575466", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1575466" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1122", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1122" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1122", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1122" }, { "category": "external", "summary": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt", "url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt" } ], "release_date": "2018-05-17T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "procps: Local privilege escalation in top" }, { "cve": "CVE-2018-5818", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "discovery_date": "2018-12-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1661608" } ], "notes": [ { "category": "description", "text": "An error within the \"parse_rollei()\" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to trigger an infinite loop.", "title": "Vulnerability description" }, { "category": "summary", "text": "LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5818" }, { "category": "external", "summary": "RHBZ#1661608", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1661608" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5818", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5818" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5818", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5818" } ], "release_date": "2018-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp" }, { "cve": "CVE-2018-5819", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-12-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1661604" } ], "notes": [ { "category": "description", "text": "An error within the \"parse_sinar_ia()\" function (internal/dcraw_common.cpp) within LibRaw versions prior to 0.19.1 can be exploited to exhaust available CPU resources.", "title": "Vulnerability description" }, { "category": "summary", "text": "LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5819" }, { "category": "external", "summary": "RHBZ#1661604", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1661604" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5819", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5819" } ], "release_date": "2018-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp" }, { "cve": "CVE-2018-12404", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-12-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1657913" } ], "notes": [ { "category": "description", "text": "A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.", "title": "Vulnerability description" }, { "category": "summary", "text": "nss: Cache side-channel variant of the Bleichenbacher attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-12404" }, { "category": "external", "summary": "RHBZ#1657913", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1657913" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12404", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12404" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12404", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12404" } ], "release_date": "2018-11-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nss: Cache side-channel variant of the Bleichenbacher attack" }, { "cve": "CVE-2018-12641", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-06-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1594410" } ], "notes": [ { "category": "description", "text": "An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg, demangle_args, and demangle_nested_args. This can occur during execution of nm-new.", "title": "Vulnerability description" }, { "category": "summary", "text": "binutils: Stack Exhaustion in the demangling functions provided by libiberty", "title": "Vulnerability summary" }, { "category": "other", "text": "The issue is classified as low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting its exploitation potential. The stack overflow in demangle_class_name() only triggers during the parsing of malformed ELF files, which would require an attacker to convince a user to process a malicious file with binutils. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-12641" }, { "category": "external", "summary": "RHBZ#1594410", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1594410" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12641", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12641" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12641", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12641" } ], "release_date": "2018-04-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "binutils: Stack Exhaustion in the demangling functions provided by libiberty" }, { "cve": "CVE-2018-12697", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2018-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1595417" } ], "notes": [ { "category": "description", "text": "A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. This can occur during execution of objdump.", "title": "Vulnerability description" }, { "category": "summary", "text": "binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c.", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue is classified with a low severity primarily because binutils is not typically exposed to untrusted inputs in most environments, limiting the possibility of exploitation. Additionally, this NULL pointer dereference is only triggered during the parsing of a specially crafted file, requiring an attacker to convince a user to process this file with objdump. Furthermore, binutils does not handle privileged operations, meaning that exploitation is unlikely to lead to system compromise or escalation of privileges. Also, the impact is limited to the application itself, without affecting the broader system or network security.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-12697" }, { "category": "external", "summary": "RHBZ#1595417", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595417" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12697", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12697" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12697", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12697" } ], "release_date": "2018-04-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c." }, { "acknowledgments": [ { "names": [ "the Curl project" ] }, { "names": [ "Zhaoyang Wu" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2018-14618", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2018-08-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1622707" } ], "notes": [ { "category": "description", "text": "curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)", "title": "Vulnerability description" }, { "category": "summary", "text": "curl: NTLM password overflow via integer overflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14618" }, { "category": "external", "summary": "RHBZ#1622707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1622707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14618", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14618" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14618", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14618" }, { "category": "external", "summary": "https://curl.haxx.se/docs/CVE-2018-14618.html", "url": "https://curl.haxx.se/docs/CVE-2018-14618.html" } ], "release_date": "2018-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "curl: NTLM password overflow via integer overflow" }, { "acknowledgments": [ { "names": [ "the Python Security Response Team" ] } ], "cve": "CVE-2018-14647", "cwe": { "id": "CWE-335", "name": "Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)" }, "discovery_date": "2018-09-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1631822" } ], "notes": [ { "category": "description", "text": "Python\u0027s elementtree C accelerator failed to initialise Expat\u0027s hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat\u0027s internal data structures, consuming large amounts CPU and RAM.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: Missing salt initialization in _elementtree.c module", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14647" }, { "category": "external", "summary": "RHBZ#1631822", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1631822" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14647", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14647" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14647", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14647" }, { "category": "external", "summary": "https://bugs.python.org/issue34623", "url": "https://bugs.python.org/issue34623" } ], "release_date": "2018-09-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: Missing salt initialization in _elementtree.c module" }, { "acknowledgments": [ { "names": [ "Jann Horn" ], "organization": "Google Project Zero" }, { "names": [ "Ubuntu" ] } ], "cve": "CVE-2018-15686", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2018-10-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1639071" } ], "notes": [ { "category": "description", "text": "It was discovered that systemd is vulnerable to a state injection attack when deserializing the state of a service. Properties longer than LINE_MAX are not correctly parsed and an attacker may abuse this flaw in particularly configured services to inject, change, or corrupt the service state.", "title": "Vulnerability description" }, { "category": "summary", "text": "systemd: line splitting via fgets() allows for state injection during daemon-reexec", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-15686" }, { "category": "external", "summary": "RHBZ#1639071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1639071" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-15686", "url": "https://www.cve.org/CVERecord?id=CVE-2018-15686" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-15686", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15686" } ], "release_date": "2018-10-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "systemd: line splitting via fgets() allows for state injection during daemon-reexec" }, { "cve": "CVE-2018-16062", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-08-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1623752" } ], "notes": [ { "category": "description", "text": "An out-of-bounds read was discovered in elfutils in the way it reads DWARF address ranges information. Function dwarf_getaranges() in dwarf_getaranges.c does not properly check whether it reads beyond the limits of the ELF section. An attacker could use this flaw to cause a denial of service via a crafted file.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16062" }, { "category": "external", "summary": "RHBZ#1623752", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1623752" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16062", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16062" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16062", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16062" } ], "release_date": "2018-08-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file" }, { "cve": "CVE-2018-16402", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1625050" } ], "notes": [ { "category": "description", "text": "libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact because it tries to decompress twice.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Double-free due to double decompression of sections in crafted ELF causes crash", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16402" }, { "category": "external", "summary": "RHBZ#1625050", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1625050" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16402", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16402" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16402", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16402" } ], "release_date": "2018-08-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Double-free due to double decompression of sections in crafted ELF causes crash" }, { "cve": "CVE-2018-16403", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-09-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1625055" } ], "notes": [ { "category": "description", "text": "libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16403" }, { "category": "external", "summary": "RHBZ#1625055", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1625055" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16403", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16403" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16403", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16403" } ], "release_date": "2018-08-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash" }, { "acknowledgments": [ { "names": [ "the Curl project" ] }, { "names": [ "Brian Carpenter" ], "organization": "Geeknik Labs", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2018-16842", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644124" } ], "notes": [ { "category": "description", "text": "Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "curl: Heap-based buffer over-read in the curl tool warning formatting", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16842" }, { "category": "external", "summary": "RHBZ#1644124", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644124" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16842", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16842" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16842", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16842" }, { "category": "external", "summary": "https://curl.haxx.se/docs/CVE-2018-16842.html", "url": "https://curl.haxx.se/docs/CVE-2018-16842.html" } ], "release_date": "2018-10-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "curl: Heap-based buffer over-read in the curl tool warning formatting" }, { "acknowledgments": [ { "names": [ "Qualys Research Labs" ] } ], "cve": "CVE-2018-16866", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1653867" } ], "notes": [ { "category": "description", "text": "An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon \u0027:\u0027. A local attacker can use this flaw to disclose process memory data.", "title": "Vulnerability description" }, { "category": "summary", "text": "systemd: out-of-bounds read when parsing a crafted syslog message", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of systemd as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having a security impact of Moderate. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.\n\nRed Hat Virtualization Hypervisor and Management Appliance include vulnerable versions of systemd. However, since exploitation requires local access and impact is restricted to information disclosure, this flaw is rated as having a security issue of Low. Future updates may address this issue.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16866" }, { "category": "external", "summary": "RHBZ#1653867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1653867" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16866", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16866" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16866", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16866" }, { "category": "external", "summary": "https://www.qualys.com/2019/01/09/system-down/system-down.txt", "url": "https://www.qualys.com/2019/01/09/system-down/system-down.txt" } ], "release_date": "2019-01-09T18:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "systemd: out-of-bounds read when parsing a crafted syslog message" }, { "cve": "CVE-2018-16888", "cwe": { "id": "CWE-250", "name": "Execution with Unnecessary Privileges" }, "discovery_date": "2019-01-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1662867" } ], "notes": [ { "category": "description", "text": "It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes.", "title": "Vulnerability description" }, { "category": "summary", "text": "systemd: kills privileged process if unprivileged PIDFile was tampered", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-16888" }, { "category": "external", "summary": "RHBZ#1662867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1662867" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-16888", "url": "https://www.cve.org/CVERecord?id=CVE-2018-16888" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-16888", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16888" } ], "release_date": "2017-08-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "systemd: kills privileged process if unprivileged PIDFile was tampered" }, { "cve": "CVE-2018-18310", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2018-10-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1642604" } ], "notes": [ { "category": "description", "text": "An invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl in elfutils through v0.174. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by consider_notes.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of elfutils as shipped with Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18310" }, { "category": "external", "summary": "RHBZ#1642604", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1642604" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18310", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18310" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18310", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18310" } ], "release_date": "2018-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl" }, { "cve": "CVE-2018-18520", "cwe": { "id": "CWE-119", "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer" }, "discovery_date": "2018-10-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1646477" } ], "notes": [ { "category": "description", "text": "An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to support ar files inside ar files, handle_ar in size.c closes the outer ar file before handling all inner entries. The vulnerability allows attackers to cause a denial of service (application crash) with a crafted ELF file.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: eu-size cannot handle recursive ar files", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of elfutils as shipped with Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18520" }, { "category": "external", "summary": "RHBZ#1646477", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646477" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18520", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18520" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18520", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18520" } ], "release_date": "2018-10-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: eu-size cannot handle recursive ar files" }, { "cve": "CVE-2018-18521", "cwe": { "id": "CWE-369", "name": "Divide By Zero" }, "discovery_date": "2018-10-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1646482" } ], "notes": [ { "category": "description", "text": "Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of service (application crash) with a crafted ELF file, as demonstrated by eu-ranlib, because a zero sh_entsize is mishandled.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of elfutils as shipped with Red Hat Enterprise Linux 5, 6, and 7.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18521" }, { "category": "external", "summary": "RHBZ#1646482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646482" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18521", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18521" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18521", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18521" } ], "release_date": "2018-10-17T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: Divide-by-zero in arlib_add_symbols function in arlib.c" }, { "cve": "CVE-2018-20217", "cwe": { "id": "CWE-617", "name": "Reachable Assertion" }, "discovery_date": "2018-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1665296" } ], "notes": [ { "category": "description", "text": "A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.", "title": "Vulnerability description" }, { "category": "summary", "text": "krb5: Reachable assertion in the KDC using S4U2Self requests", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-20217" }, { "category": "external", "summary": "RHBZ#1665296", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1665296" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-20217", "url": "https://www.cve.org/CVERecord?id=CVE-2018-20217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-20217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20217" } ], "release_date": "2018-12-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "krb5: Reachable assertion in the KDC using S4U2Self requests" }, { "cve": "CVE-2018-1000876", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2018-12-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1664699" } ], "notes": [ { "category": "description", "text": "binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that can result in Integer overflow trigger heap overflow. Successful exploitation allows execution of arbitrary code.. This attack appear to be exploitable via Local. This vulnerability appears to have been fixed in after commit 3a551c7a1b80fca579461774860574eabfd7f18f.", "title": "Vulnerability description" }, { "category": "summary", "text": "binutils: integer overflow leads to heap-based buffer overflow in objdump", "title": "Vulnerability summary" }, { "category": "other", "text": "The issue is classified as moderate severity primarily because of the unlikelihood of running a 32bit compiled objdump and/or having a compiled binary that uses 32bit compiled binutils libraries to analyze binaries from a not trusted source. Moreover, binutils does not handle privileged operations, meaning exploitation is unlikely to lead to system compromise or escalation of privileges. Additionally, the impact is localized to the application itself, without affecting the broader system or network security. \n\nAs per upstream binutils security policy this issue is not considered as a security flaw. Basically the key element of the policy that affects this is the understanding that analysis of untrusted binaries must always be done in a sandbox because the ELF format is open ended enough to make the analysis tools do anything, like including and processing arbitrary files. This eliminates the only possible vulnerability vector here, which is the possibility of a user being tricked into downloading and analyzing an untrusted ELF without sandboxing.\n\nSee the binutils security policy for more details:\nhttps://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-190: Integer Overflow leading to a CWE-122: Heap-based Buffer Overflow vulnerability, and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nAccess to the platform is granted only after successful hard token-based multi-factor authentication (MFA) and enforced through least privilege, ensuring only authorized users can execute or modify code. Red Hat also applies least functionality, enabling only essential features, services, and ports to reduce the attack surface for heap-based buffer overflow exploits. The environment uses IPS/IDS and antimalware solutions to detect and respond to threats in real time, helping prevent or limit exploitation attempts. Static code analysis and peer reviews ensure all user inputs are thoroughly validated, reducing the risk of system instability, data exposure, or privilege escalation. Finally, memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) enhance resilience against buffer overflows and denial-of-service attacks.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-1000876" }, { "category": "external", "summary": "RHBZ#1664699", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1664699" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1000876", "url": "https://www.cve.org/CVERecord?id=CVE-2018-1000876" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000876", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000876" } ], "release_date": "2018-12-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "binutils: integer overflow leads to heap-based buffer overflow in objdump" }, { "cve": "CVE-2019-1559", "cwe": { "id": "CWE-325", "name": "Missing Cryptographic Step" }, "discovery_date": "2019-02-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1683804" } ], "notes": [ { "category": "description", "text": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: 0-byte record padding oracle", "title": "Vulnerability summary" }, { "category": "other", "text": "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1559" }, { "category": "external", "summary": "RHBZ#1683804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1559", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1559" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559" }, { "category": "external", "summary": "https://github.com/RUB-NDS/TLS-Padding-Oracles", "url": "https://github.com/RUB-NDS/TLS-Padding-Oracles" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20190226.txt", "url": "https://www.openssl.org/news/secadv/20190226.txt" } ], "release_date": "2019-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: 0-byte record padding oracle" }, { "acknowledgments": [ { "names": [ "the libssh2 project" ] }, { "names": [ "Chris Coulson" ], "organization": "Canonical Ltd.", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-3858", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-03-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1687306" } ], "notes": [ { "category": "description", "text": "An out of bounds read flaw was discovered in libssh2 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.\n\nlibssh2 is no longer included in the virt module since Red Hat Enterprise Linux 8.1.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-3858" }, { "category": "external", "summary": "RHBZ#1687306", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687306" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3858", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3858" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3858", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3858" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3858.html", "url": "https://www.libssh2.org/CVE-2019-3858.html" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read" }, { "acknowledgments": [ { "names": [ "the libssh2 project" ] }, { "names": [ "Chris Coulson" ], "organization": "Canonical Ltd.", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-3861", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-03-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1687311" } ], "notes": [ { "category": "description", "text": "An out of bounds read flaw was discovered in libssh2 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh2: Out-of-bounds reads with specially crafted SSH packets", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.\n\nlibssh2 is no longer included in the virt module since Red Hat Enterprise Linux 8.1.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-3861" }, { "category": "external", "summary": "RHBZ#1687311", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687311" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3861", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3861" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3861", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3861" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3861.html", "url": "https://www.libssh2.org/CVE-2019-3861.html" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libssh2: Out-of-bounds reads with specially crafted SSH packets" }, { "acknowledgments": [ { "names": [ "the libssh2 project" ] }, { "names": [ "Chris Coulson" ], "organization": "Canonical Ltd.", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-3862", "cwe": { "id": "CWE-130", "name": "Improper Handling of Length Parameter Inconsistency" }, "discovery_date": "2019-03-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1687312" } ], "notes": [ { "category": "description", "text": "An out of bounds read flaw was discovered in libssh2 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory.", "title": "Vulnerability description" }, { "category": "summary", "text": "libssh2: Out-of-bounds memory comparison with specially crafted message channel request", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw was present in libssh2 packages included in Red Hat Virtualization Hypervisor and Management Appliance, however libssh2 in these hosts is never exposed to malicious clients or servers.\n\nlibssh2 is no longer included in the virt module since Red Hat Enterprise Linux 8.1.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-3862" }, { "category": "external", "summary": "RHBZ#1687312", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687312" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3862", "url": "https://www.cve.org/CVERecord?id=CVE-2019-3862" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3862", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3862" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3862.html", "url": "https://www.libssh2.org/CVE-2019-3862.html" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libssh2: Out-of-bounds memory comparison with specially crafted message channel request" }, { "cve": "CVE-2019-5010", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "discovery_date": "2019-01-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1666519" } ], "notes": [ { "category": "description", "text": "A null pointer dereference vulnerability was found in the certificate parsing code in Python. This causes a denial of service to applications when parsing specially crafted certificates. This vulnerability is unlikely to be triggered if application enables SSL/TLS certificate validation and accepts certificates only from trusted root certificate authorities.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: NULL pointer dereference using a specially crafted X509 certificate", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue did not affect the versions of python as shipped with Red Hat Enterprise Linux 5 and 6.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5010" }, { "category": "external", "summary": "RHBZ#1666519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666519" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5010", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5010" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5010", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5010" }, { "category": "external", "summary": "https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html", "url": "https://python-security.readthedocs.io/vuln/ssl-crl-dps-dos.html" } ], "release_date": "2019-01-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: NULL pointer dereference using a specially crafted X509 certificate" }, { "cve": "CVE-2019-7149", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-01-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1671443" } ], "notes": [ { "category": "description", "text": "A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7149" }, { "category": "external", "summary": "RHBZ#1671443", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671443" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7149", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7149" } ], "release_date": "2019-01-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: heap-based buffer over-read in read_srclines in dwarf_getsrclines.c in libdw" }, { "cve": "CVE-2019-7150", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "discovery_date": "2019-01-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1671446" } ], "notes": [ { "category": "description", "text": "An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64_xlatetom in libelf/elf32_xlatetom.c, due to dwfl_segment_report_module not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7150" }, { "category": "external", "summary": "RHBZ#1671446", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671446" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7150", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7150" } ], "release_date": "2018-10-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: segmentation fault in elf64_xlatetom in libelf/elf32_xlatetom.c" }, { "cve": "CVE-2019-7664", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2019-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1677536" } ], "notes": [ { "category": "description", "text": "In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check. Crafted elf input causes a segmentation fault, leading to denial of service (program crash).", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7664" }, { "category": "external", "summary": "RHBZ#1677536", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677536" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7664", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7664" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7664", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7664" } ], "release_date": "2019-01-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: out of bound write in elf_cvt_note in libelf/note_xlate.h" }, { "cve": "CVE-2019-7665", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2019-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1677538" } ], "notes": [ { "category": "description", "text": "In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.", "title": "Vulnerability description" }, { "category": "summary", "text": "elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7665" }, { "category": "external", "summary": "RHBZ#1677538", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677538" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7665", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7665" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7665", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7665" } ], "release_date": "2019-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c" }, { "cve": "CVE-2019-9740", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688169" } ], "notes": [ { "category": "description", "text": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: CRLF injection via the query part of the url passed to urlopen()", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects:\n* All current versions of Red Hat OpenStack Platform. However, version 8 is due to retire on the 20th of April 2019, there are no more planned releases prior to this date.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9740" }, { "category": "external", "summary": "RHBZ#1688169", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688169" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9740", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9740" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9740", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9740" } ], "release_date": "2019-03-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: CRLF injection via the query part of the url passed to urlopen()" }, { "cve": "CVE-2019-9947", "cwe": { "id": "CWE-113", "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695572" } ], "notes": [ { "category": "description", "text": "An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: CRLF injection via the path part of the url passed to urlopen()", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9947" }, { "category": "external", "summary": "RHBZ#1695572", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695572" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9947", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9947" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9947", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9947" } ], "release_date": "2019-03-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: CRLF injection via the path part of the url passed to urlopen()" }, { "cve": "CVE-2019-9948", "cwe": { "id": "CWE-749", "name": "Exposed Dangerous Method or Function" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695570" } ], "notes": [ { "category": "description", "text": "urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen(\u0027local_file:///etc/passwd\u0027) call.", "title": "Vulnerability description" }, { "category": "summary", "text": "python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9948" }, { "category": "external", "summary": "RHBZ#1695570", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695570" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9948", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9948" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9948", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9948" } ], "release_date": "2019-03-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "If your application uses a blacklist to prevent \"file://\" schema from being used, consider using a whitelist approach to just allow the schemas you want or add \"local_file://\" schema to your blacklist.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python: Undocumented local_file protocol allows remote attackers to bypass protection mechanisms" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Jonas Allmann" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11729", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-07-10T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1728437" } ], "notes": [ { "category": "description", "text": "Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR \u003c 60.8, Firefox \u003c 68, and Thunderbird \u003c 60.8.", "title": "Vulnerability description" }, { "category": "summary", "text": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault", "title": "Vulnerability summary" }, { "category": "other", "text": "Firefox on Red Hat Enterprise Linux is built against the system nss library.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11729" }, { "category": "external", "summary": "RHBZ#1728437", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728437" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11729", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11729" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11729", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11729" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729" } ], "release_date": "2019-07-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nss: Empty or malformed p256-ECDH public keys may trigger a segmentation fault" }, { "acknowledgments": [ { "names": [ "the Mozilla Project" ] } ], "cve": "CVE-2019-11745", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2019-11-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1774831" } ], "notes": [ { "category": "description", "text": "A heap-based buffer overflow was found in the NSC_EncryptUpdate() function in Mozilla nss. A remote attacker could trigger this flaw via SRTP encrypt or decrypt operations, to execute arbitrary code with the permissions of the user running the application (compiled with nss). While the attack complexity is high, the impact to confidentiality, integrity, and availability are high as well.", "title": "Vulnerability description" }, { "category": "summary", "text": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate", "title": "Vulnerability summary" }, { "category": "other", "text": "Firefox and Thunderbird on Red Hat Enterprise Linux are built against the system nss library.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11745" }, { "category": "external", "summary": "RHBZ#1774831", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1774831" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11745", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11745" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11745", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11745" }, { "category": "external", "summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes", "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.44.3_release_notes" }, { "category": "external", "summary": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes", "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47.1_release_notes" } ], "release_date": "2019-11-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate" }, { "cve": "CVE-2019-13734", "discovery_date": "2019-12-10T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1781980" } ], "notes": [ { "category": "description", "text": "Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "sqlite: fts3: improve shadow table corruption detection", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-13734" }, { "category": "external", "summary": "RHBZ#1781980", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1781980" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-13734", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-13734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13734" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html" } ], "release_date": "2019-12-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "sqlite: fts3: improve shadow table corruption detection" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1734", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)" }, "discovery_date": "2019-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1801804" } ], "notes": [ { "category": "description", "text": "A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: shell enabled by default in a pipe lookup plugin subprocess", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1734" }, { "category": "external", "summary": "RHBZ#1801804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801804" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1734", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1734" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "This issue can be avoided by escaping variables which are used in the lookup.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ansible: shell enabled by default in a pipe lookup plugin subprocess" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1735", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802085" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: path injection on dest parameter in fetch module", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1735" }, { "category": "external", "summary": "RHBZ#1802085", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802085" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1735", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1735" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except avoid using the affected fetch module when possible.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ansible: path injection on dest parameter in fetch module" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1736", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802124" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This issue affects only the newly created files and not existing ones. If the file already exists at the final destination, those permissions are retained. This could lead to the disclosure of sensitive data.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: atomic_move primitive sets permissive permissions", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.8.14 and 2.9.12 as well as previous versions and all 2.7.x versions are affected.\n\nAnsible Tower 3.6.5 and 3.7.2 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1736" }, { "category": "external", "summary": "RHBZ#1802124", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802124" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1736", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1736" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1736", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1736" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "This issue can be mitigated by specifying the \"mode\" on the task. That just leaves a race condition in place where newly created files that specify a mode in the task briefly go from 666 - umask to the final mode. An alternative workaround if many new files are created and to avoid setting a specific mode for each file would be to set the \"mode\" to \"preserve\" value. That will maintain the permissions of the source file on the controller in the final file on the managed host.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: atomic_move primitive sets permissive permissions" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1737", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2020-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802154" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: Extract-Zip function in win_unzip module does not check extracted path", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1737" }, { "category": "external", "summary": "RHBZ#1802154", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802154" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1737", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1737" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except avoid using the affected win_unzip module when possible.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ansible: Extract-Zip function in win_unzip module does not check extracted path" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1738", "cwe": { "id": "CWE-88", "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802164" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine when the module package or service is used and the parameter \u0027use\u0027 is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: module package can be selected by the ansible facts", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1738" }, { "category": "external", "summary": "RHBZ#1802164", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802164" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1738", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1738" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1738", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1738" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Specify the parameter \u0027use\u0027 when possible on the package and service modules. Avoid using Ansible Collections on Ansible 2.8.9 or 2.7.16 (and any of the previous versions) as they are not rejecting python with no path (already fixed in 2.9.x).", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: module package can be selected by the ansible facts" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1739", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802178" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine. When a password is set with the argument \"password\" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: svn module leaks password when specified as a parameter", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1739" }, { "category": "external", "summary": "RHBZ#1802178", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802178" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1739", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1739" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1739", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1739" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Instead of using the parameter \u0027password\u0027 of the subversion module, provide the password with stdin.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: svn module leaks password when specified as a parameter" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-1740", "cwe": { "id": "CWE-377", "name": "Insecure Temporary File" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1802193" } ], "notes": [ { "category": "description", "text": "A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes \"ansible-vault edit\", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: secrets readable after ansible-vault edit", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1740" }, { "category": "external", "summary": "RHBZ#1802193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802193" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1740", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1740" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1740", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1740" } ], "release_date": "2020-02-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except avoid using the \u0027edit\u0027 option from \u0027ansible-vault\u0027 command line tool.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: secrets readable after ansible-vault edit" }, { "acknowledgments": [ { "names": [ "Felix Fountein" ] } ], "cve": "CVE-2020-1746", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2019-12-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1805491" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible: Information disclosure issue in ldap_attr and ldap_entry modules", "title": "Vulnerability summary" }, { "category": "other", "text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\n* Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be provided from core Ansible. But we still ship ansible separately for ceph ubuntu.\n\n* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1746" }, { "category": "external", "summary": "RHBZ#1805491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805491" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1746", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1746" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1746", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1746" } ], "release_date": "2020-02-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Using args keyword and embedding the ldap_auth variable instead of using bind_pw parameter would mitigate this issue.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "ansible: Information disclosure issue in ldap_attr and ldap_entry modules" }, { "acknowledgments": [ { "names": [ "Abhijeet Kasurde" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-1753", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "discovery_date": "2020-03-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1811008" } ], "notes": [ { "category": "description", "text": "A security flaw was found in the Ansible Engine when managing Kubernetes using the k8s connection plugin. Sensitive parameters such as passwords and tokens are passed to the kubectl command line instead of using environment variables or an input configuration file, which is safer. This flaw discloses passwords and tokens from the process list, and the no_log directive from the debug module would not be reflected in the underlying command-line tools options, displaying passwords and tokens on stdout and log files.", "title": "Vulnerability description" }, { "category": "summary", "text": "Ansible: kubectl connection plugin leaks sensitive information", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Engine 2.7.17, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1753" }, { "category": "external", "summary": "RHBZ#1811008", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811008" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1753", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1753" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1753", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1753" } ], "release_date": "2020-03-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Ansible: kubectl connection plugin leaks sensitive information" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-10684", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1815519" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Ansible Engine. When using ansible_facts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansible_facts after the clean, an attacker could take advantage of this by altering the ansible_facts leading to privilege escalation or code injection. The highest threat from this vulnerability are to data integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "Ansible: code injection when using ansible_facts as a subkey", "title": "Vulnerability summary" }, { "category": "other", "text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n* Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be consumed from core Ansible. But we still ship ansible separately for ceph ubuntu.\n* Red Hat OpenStack Platform does package the affected code. However, because RHOSP does not use ansible_facts as a subkey directly, the RHOSP impact has been reduced to Moderate and no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10684" }, { "category": "external", "summary": "RHBZ#1815519", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815519" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10684", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10684" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10684", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10684" } ], "release_date": "2020-03-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is not a known mitigation except avoiding the functionality of using ansible_facts as a subkey.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Ansible: code injection when using ansible_facts as a subkey" }, { "acknowledgments": [ { "names": [ "Damien Aumaitre", "Nicolas Surbayrole" ], "organization": "Quarkslab" } ], "cve": "CVE-2020-10685", "cwe": { "id": "CWE-459", "name": "Incomplete Cleanup" }, "discovery_date": "2020-01-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1814627" } ], "notes": [ { "category": "description", "text": "A flaw was found on Ansible Engine when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the secrets unencrypted.\r\n\r\nOn Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decrypted data remains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted is sensible.", "title": "Vulnerability description" }, { "category": "summary", "text": "Ansible: modules which use files encrypted with vault are not properly cleaned up", "title": "Vulnerability summary" }, { "category": "other", "text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\n* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10685" }, { "category": "external", "summary": "RHBZ#1814627", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814627" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10685", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10685" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685" } ], "release_date": "2020-03-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-02-18T15:13:57+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHBA-2020:0547" }, { "category": "workaround", "details": "Currently, there is no mitigation for this issue except by removing manually the temporary created file after every run.", "product_ids": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.4:ansible-tower-34/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-35/ansible-tower-memcached@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64", "7Server-Ansible-Tower-3.4:ansible-tower-37/ansible-tower-memcached-rhel7@sha256:25003890d7f04dbc7741c78a9977f0b5071d2c6653a6fc5baff23abe7d71403c_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Ansible: modules which use files encrypted with vault are not properly cleaned up" } ] }
rhsa-2019:3932
Vulnerability from csaf_redhat
Published
2019-11-20 16:22
Modified
2025-07-09 04:58
Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6
Notes
Topic
Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3932", "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "JBCS-798", "url": "https://issues.redhat.com/browse/JBCS-798" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3932.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6", "tracking": { "current_release_date": "2025-07-09T04:58:58+00:00", "generator": { "date": "2025-07-09T04:58:58+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2019:3932", "initial_release_date": "2019-11-20T16:22:09+00:00", "revision_history": [ { "date": "2019-11-20T16:22:09+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-01-06T13:05:52+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-09T04:58:58+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Core Services on RHEL 6 Server", "product": { "name": "Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1::el6" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "product_id": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-devel@2.11-20.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "product_id": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-debuginfo@2.11-20.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-63.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-63.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-devel@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-ldap@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-mysql@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-nss@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-odbc@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-openssl@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-pgsql@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-sqlite@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-debuginfo@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-7.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-7.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "product_id": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-devel@1.39.2-4.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "product_id": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-debuginfo@1.39.2-4.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl-devel@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl-debuginfo@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-33.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-33.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-9.Final_redhat_2.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.46-22.redhat_1.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-manual@1.2.46-22.redhat_1.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-debuginfo@1.2.46-22.redhat_1.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.2-16.GA.jbcs.el6?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-devel@2.11-20.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-debuginfo@2.11-20.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-63.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-63.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-devel@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-ldap@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-mysql@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-nss@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-odbc@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-openssl@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-pgsql@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-sqlite@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-debuginfo@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-7.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-7.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-devel@1.39.2-4.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-debuginfo@1.39.2-4.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl-devel@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl-debuginfo@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-33.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-33.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-9.Final_redhat_2.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.46-22.redhat_1.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-manual@1.2.46-22.redhat_1.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-debuginfo@1.2.46-22.redhat_1.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.2-16.GA.jbcs.el6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el6?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk@1.2.46-22.redhat_1.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "product": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "product_id": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.37-33.jbcs.el6?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch" }, "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0737", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568253" } ], "notes": [ { "category": "description", "text": "OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0737" }, { "category": "external", "summary": "RHBZ#1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2018/04/16/3", "url": "http://www.openwall.com/lists/oss-security/2018/04/16/3" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20180416.txt", "url": "https://www.openssl.org/news/secadv/20180416.txt" } ], "release_date": "2018-04-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys" }, { "acknowledgments": [ { "names": [ "Alejandro Cabrera Aldaya" ], "organization": "Universidad Tecnologica de la Habana CUJAE; Cuba" }, { "names": [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan" ] }, { "names": [ "Nicola Tuveri" ], "organization": "Tampere University of Technology; Finland" } ], "cve": "CVE-2018-5407", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1645695" } ], "notes": [ { "category": "description", "text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", "title": "Vulnerability summary" }, { "category": "other", "text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5407" }, { "category": "external", "summary": "RHBZ#1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407" }, { "category": "external", "summary": "https://github.com/bbbrumley/portsmash", "url": "https://github.com/bbbrumley/portsmash" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20181112.txt", "url": "https://www.openssl.org/news/secadv/20181112.txt" } ], "release_date": "2018-10-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)" }, { "cve": "CVE-2018-17189", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668497" } ], "notes": [ { "category": "description", "text": "In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: DoS via slow, unneeded request bodies", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17189" }, { "category": "external", "summary": "RHBZ#1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17189", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17189" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: DoS via slow, unneeded request bodies" }, { "cve": "CVE-2018-17199", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668493" } ], "notes": [ { "category": "description", "text": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_session_cookie does not respect expiry time", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17199" }, { "category": "external", "summary": "RHBZ#1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17199", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17199" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_session_cookie does not respect expiry time" }, { "cve": "CVE-2019-0196", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695030" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: read-after-free on a string compare", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0196" }, { "category": "external", "summary": "RHBZ#1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0196", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0196" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: read-after-free on a string compare" }, { "cve": "CVE-2019-0197", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695042" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: possible crash on late upgrade", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0197" }, { "category": "external", "summary": "RHBZ#1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0197", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0197" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-02-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: possible crash on late upgrade" }, { "cve": "CVE-2019-0217", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695020" } ], "notes": [ { "category": "description", "text": "A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_auth_digest: access control bypass due to race condition", "title": "Vulnerability summary" }, { "category": "other", "text": "Based on the the fact that digest authentication is rarely used in modern day web applications and httpd package shipped with Red Hat products do not ship threaded MPM configuration by default, this flaw has been rated as having Moderate level security impact. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0217" }, { "category": "external", "summary": "RHBZ#1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0217", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "This flaw only affects a threaded server configuration, so using the prefork MPM is an effective mitigation. In versions of httpd package shipped with Red Hat Enterprise Linux 7, the prefork MPM is the default configuration.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_auth_digest: access control bypass due to race condition" }, { "cve": "CVE-2019-9511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741860" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: large amount of data requests leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "There are no mitigations available for nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9511" }, { "category": "external", "summary": "RHBZ#1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9511", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: large amount of data requests leads to denial of service" }, { "acknowledgments": [ { "names": [ "the Envoy security team" ] } ], "cve": "CVE-2019-9513", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1735741" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for packages nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9513" }, { "category": "external", "summary": "RHBZ#1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9513", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9513" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/", "url": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption" }, { "cve": "CVE-2019-9516", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741864" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: 0-length headers lead to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9516" }, { "category": "external", "summary": "RHBZ#1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9516", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9516" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://github.com/nghttp2/nghttp2/issues/1382#", "url": "https://github.com/nghttp2/nghttp2/issues/1382#" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: 0-length headers lead to denial of service" }, { "cve": "CVE-2019-9517", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741868" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server\u0027s queue is setup, the responses can consume excess memory, CPU, or both, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: request for large response leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "The package httpd versions as shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this issue as HTTP/2 support is not provided.\nThis flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9517" }, { "category": "external", "summary": "RHBZ#1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9517", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps:\n\n1. Stop httpd service:\n$ systemctl stop httpd\n\n2. Remove http/2 protocol support from configuration files:\n$ sed -i \u0027s/\\(h2\\)\\|\\(h2c\\)//g\u0027 \u003chttpd_config_file\u003e\n\n3. Validate configuration files to make sure all syntax is valid:\n$ apachectl configtest\n\n4. Restart httpd service:\n$ systemctl start httpd", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: request for large response leads to denial of service" } ] }
RHSA-2019:3933
Vulnerability from csaf_redhat
Published
2019-11-20 16:14
Modified
2025-07-09 04:58
Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7
Notes
Topic
An update is now available for JBoss Core Services on RHEL 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737)
* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)
* mod_auth_digest: access control bypass due to race condition (CVE-2019-0217)
* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
* mod_session_cookie does not respect expiry time (CVE-2018-17199)
* mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)
* mod_http2: possible crash on late upgrade (CVE-2019-0197)
* mod_http2: read-after-free on a string compare (CVE-2019-0196)
* nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)
* nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)
* mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)
* mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for JBoss Core Services on RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737)\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n* mod_auth_digest: access control bypass due to race condition (CVE-2019-0217)\n* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)\n* mod_session_cookie does not respect expiry time (CVE-2018-17199)\n* mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)\n* mod_http2: possible crash on late upgrade (CVE-2019-0197)\n* mod_http2: read-after-free on a string compare (CVE-2019-0196)\n* nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511)\n* nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)\n* mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516)\n* mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3933", "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "JBCS-798", "url": "https://issues.redhat.com/browse/JBCS-798" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3933.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7", "tracking": { "current_release_date": "2025-07-09T04:58:51+00:00", "generator": { "date": "2025-07-09T04:58:51+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2019:3933", "initial_release_date": "2019-11-20T16:14:21+00:00", "revision_history": [ { "date": "2019-11-20T16:14:21+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-01-06T13:04:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-09T04:58:51+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Core Services on RHEL 7 Server", "product": { "name": "Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1::el7" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-devel@2.11-20.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-debuginfo@2.11-20.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-63.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-63.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1-25.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-devel@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-ldap@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-mysql@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-nss@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-odbc@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-openssl@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-pgsql@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-sqlite@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-debuginfo@1.6.1-48.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-7.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-7.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-devel@1.39.2-4.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-debuginfo@1.39.2-4.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl-devel@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl-debuginfo@7.64.1-14.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-33.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-33.jbcs.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-33.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.46-22.redhat_1.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-manual@1.2.46-22.redhat_1.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-debuginfo@1.2.46-22.redhat_1.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-9.Final_redhat_2.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el7?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "product": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.2-16.GA.jbcs.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el7?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk@1.2.46-22.redhat_1.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el7?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "product": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "product_id": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.37-33.jbcs.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch" }, "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server", "product_id": "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64", "relates_to_product_reference": "7Server-JBCS" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0737", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568253" } ], "notes": [ { "category": "description", "text": "OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0737" }, { "category": "external", "summary": "RHBZ#1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2018/04/16/3", "url": "http://www.openwall.com/lists/oss-security/2018/04/16/3" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20180416.txt", "url": "https://www.openssl.org/news/secadv/20180416.txt" } ], "release_date": "2018-04-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys" }, { "acknowledgments": [ { "names": [ "Alejandro Cabrera Aldaya" ], "organization": "Universidad Tecnologica de la Habana CUJAE; Cuba" }, { "names": [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan" ] }, { "names": [ "Nicola Tuveri" ], "organization": "Tampere University of Technology; Finland" } ], "cve": "CVE-2018-5407", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1645695" } ], "notes": [ { "category": "description", "text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", "title": "Vulnerability summary" }, { "category": "other", "text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5407" }, { "category": "external", "summary": "RHBZ#1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407" }, { "category": "external", "summary": "https://github.com/bbbrumley/portsmash", "url": "https://github.com/bbbrumley/portsmash" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20181112.txt", "url": "https://www.openssl.org/news/secadv/20181112.txt" } ], "release_date": "2018-10-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)" }, { "cve": "CVE-2018-17189", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668497" } ], "notes": [ { "category": "description", "text": "In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: DoS via slow, unneeded request bodies", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17189" }, { "category": "external", "summary": "RHBZ#1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17189", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17189" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: DoS via slow, unneeded request bodies" }, { "cve": "CVE-2018-17199", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668493" } ], "notes": [ { "category": "description", "text": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_session_cookie does not respect expiry time", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17199" }, { "category": "external", "summary": "RHBZ#1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17199", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17199" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_session_cookie does not respect expiry time" }, { "cve": "CVE-2019-0196", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695030" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: read-after-free on a string compare", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0196" }, { "category": "external", "summary": "RHBZ#1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0196", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0196" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: read-after-free on a string compare" }, { "cve": "CVE-2019-0197", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695042" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: possible crash on late upgrade", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0197" }, { "category": "external", "summary": "RHBZ#1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0197", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0197" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-02-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: possible crash on late upgrade" }, { "cve": "CVE-2019-0217", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695020" } ], "notes": [ { "category": "description", "text": "A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_auth_digest: access control bypass due to race condition", "title": "Vulnerability summary" }, { "category": "other", "text": "Based on the the fact that digest authentication is rarely used in modern day web applications and httpd package shipped with Red Hat products do not ship threaded MPM configuration by default, this flaw has been rated as having Moderate level security impact. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0217" }, { "category": "external", "summary": "RHBZ#1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0217", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "This flaw only affects a threaded server configuration, so using the prefork MPM is an effective mitigation. In versions of httpd package shipped with Red Hat Enterprise Linux 7, the prefork MPM is the default configuration.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_auth_digest: access control bypass due to race condition" }, { "cve": "CVE-2019-9511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741860" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: large amount of data requests leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "There are no mitigations available for nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9511" }, { "category": "external", "summary": "RHBZ#1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9511", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: large amount of data requests leads to denial of service" }, { "acknowledgments": [ { "names": [ "the Envoy security team" ] } ], "cve": "CVE-2019-9513", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1735741" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for packages nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9513" }, { "category": "external", "summary": "RHBZ#1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9513", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9513" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/", "url": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption" }, { "cve": "CVE-2019-9516", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741864" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: 0-length headers lead to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9516" }, { "category": "external", "summary": "RHBZ#1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9516", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9516" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://github.com/nghttp2/nghttp2/issues/1382#", "url": "https://github.com/nghttp2/nghttp2/issues/1382#" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: 0-length headers lead to denial of service" }, { "cve": "CVE-2019-9517", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741868" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server\u0027s queue is setup, the responses can consume excess memory, CPU, or both, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: request for large response leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "The package httpd versions as shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this issue as HTTP/2 support is not provided.\nThis flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9517" }, { "category": "external", "summary": "RHBZ#1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9517", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:14:21+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "workaround", "details": "The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps:\n\n1. Stop httpd service:\n$ systemctl stop httpd\n\n2. Remove http/2 protocol support from configuration files:\n$ sed -i \u0027s/\\(h2\\)\\|\\(h2c\\)//g\u0027 \u003chttpd_config_file\u003e\n\n3. Validate configuration files to make sure all syntax is valid:\n$ apachectl configtest\n\n4. Restart httpd service:\n$ systemctl start httpd", "product_ids": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el7.noarch", "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.src", "7Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el7.x86_64", "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: request for large response leads to denial of service" } ] }
rhsa-2019_3700
Vulnerability from csaf_redhat
Published
2019-11-05 22:28
Modified
2024-11-22 13:17
Summary
Red Hat Security Advisory: openssl security, bug fix, and enhancement update
Notes
Topic
An update for openssl is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
The following packages have been upgraded to a later upstream version: openssl (1.1.1c). (BZ#1643026)
Security Fix(es):
* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)
* openssl: timing side channel attack in the ECDSA signature generation (CVE-2018-0735)
* openssl: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Low" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openssl is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nThe following packages have been upgraded to a later upstream version: openssl (1.1.1c). (BZ#1643026)\n\nSecurity Fix(es):\n\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n\n* openssl: timing side channel attack in the ECDSA signature generation (CVE-2018-0735)\n\n* openssl: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3700", "url": "https://access.redhat.com/errata/RHSA-2019:3700" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#low", "url": "https://access.redhat.com/security/updates/classification/#low" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/" }, { "category": "external", "summary": "1644356", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644356" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1668880", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668880" }, { "category": "external", "summary": "1686058", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686058" }, { "category": "external", "summary": "1686548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686548" }, { "category": "external", "summary": "1695954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695954" }, { "category": "external", "summary": "1697915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1697915" }, { "category": "external", "summary": "1706104", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706104" }, { "category": "external", "summary": "1706915", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706915" }, { "category": "external", "summary": "1712023", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712023" }, { "category": "external", "summary": "1714245", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1714245" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3700.json" } ], "title": "Red Hat Security Advisory: openssl security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T13:17:17+00:00", "generator": { "date": "2024-11-22T13:17:17+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:3700", "initial_release_date": "2019-11-05T22:28:48+00:00", "revision_history": [ { "date": "2019-11-05T22:28:48+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-11-05T22:28:48+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:17:17+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux BaseOS (v. 8)", "product": { "name": "Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8::baseos" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-libs-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-perl-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-devel-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=aarch64\u0026epoch=1" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-libs-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-perl-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-devel-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.i686", "product_id": "openssl-libs-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.i686", "product_id": "openssl-devel-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.i686", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.s390x", "product_id": "openssl-libs-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.s390x", "product_id": "openssl-perl-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.s390x", "product_id": "openssl-devel-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-1:1.1.1c-2.el8.s390x", "product_id": "openssl-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debugsource@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "product": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_id": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs-debuginfo@1.1.1c-2.el8?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.1.1c-2.el8.src", "product": { "name": "openssl-1:1.1.1c-2.el8.src", "product_id": "openssl-1:1.1.1c-2.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.1.1c-2.el8?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src" }, "product_reference": "openssl-1:1.1.1c-2.el8.src", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debugsource-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-debugsource-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-devel-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-libs-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.aarch64", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.ppc64le", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.s390x", "relates_to_product_reference": "BaseOS-8.1.0" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.1.1c-2.el8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)", "product_id": "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" }, "product_reference": "openssl-perl-1:1.1.1c-2.el8.x86_64", "relates_to_product_reference": "BaseOS-8.1.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-05T22:28:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3700" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0735", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644356" } ], "notes": [ { "category": "description", "text": "The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the ECDSA signature generation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0735" }, { "category": "external", "summary": "RHBZ#1644356", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644356" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0735", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0735" } ], "release_date": "2018-10-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-05T22:28:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3700" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the ECDSA signature generation" }, { "cve": "CVE-2019-1543", "cwe": { "id": "CWE-323", "name": "Reusing a Nonce, Key Pair in Encryption" }, "discovery_date": "2019-03-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695954" } ], "notes": [ { "category": "description", "text": "ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: ChaCha20-Poly1305 with long nonces", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1543" }, { "category": "external", "summary": "RHBZ#1695954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695954" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1543", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1543" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1543", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1543" } ], "release_date": "2019-03-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-05T22:28:48+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3700" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.0" }, "products": [ "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.src", "BaseOS-8.1.0:openssl-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-debugsource-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-devel-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.i686", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-libs-debuginfo-1:1.1.1c-2.el8.x86_64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.aarch64", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.ppc64le", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.s390x", "BaseOS-8.1.0:openssl-perl-1:1.1.1c-2.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: ChaCha20-Poly1305 with long nonces" } ] }
rhsa-2019_2304
Vulnerability from csaf_redhat
Published
2019-08-06 13:42
Modified
2024-11-22 12:46
Summary
Red Hat Security Advisory: openssl security and bug fix update
Notes
Topic
An update for openssl is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.
Security Fix(es):
* openssl: 0-byte record padding oracle (CVE-2019-1559)
* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for openssl is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: 0-byte record padding oracle (CVE-2019-1559)\n\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:2304", "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1649568", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1649568" }, { "category": "external", "summary": "1683804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2304.json" } ], "title": "Red Hat Security Advisory: openssl security and bug fix update", "tracking": { "current_release_date": "2024-11-22T12:46:49+00:00", "generator": { "date": "2024-11-22T12:46:49+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:2304", "initial_release_date": "2019-08-06T13:42:09+00:00", "revision_history": [ { "date": "2019-08-06T13:42:09+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-08-06T13:42:09+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T12:46:49+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ComputeNode (v. 7)", "product": { "name": "Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-perl-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-static-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-devel-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.x86_64", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64", "product_id": "openssl-libs-1:1.0.2k-19.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=x86_64\u0026epoch=1" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-static-1:1.0.2k-19.el7.i686", "product_id": "openssl-static-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.i686", "product_id": "openssl-devel-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.i686", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.i686", "product_id": "openssl-libs-1:1.0.2k-19.el7.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=i686\u0026epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.src", "product": { "name": "openssl-1:1.0.2k-19.el7.src", "product_id": "openssl-1:1.0.2k-19.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x", "product_id": "openssl-perl-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-static-1:1.0.2k-19.el7.s390x", "product_id": "openssl-static-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-1:1.0.2k-19.el7.s390x", "product_id": "openssl-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x", "product_id": "openssl-devel-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.s390x", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x", "product_id": "openssl-libs-1:1.0.2k-19.el7.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=s390x\u0026epoch=1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-static-1:1.0.2k-19.el7.s390", "product_id": "openssl-static-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.s390", "product_id": "openssl-devel-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.s390", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.s390", "product_id": "openssl-libs-1:1.0.2k-19.el7.s390", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=s390\u0026epoch=1" } } } ], "category": "architecture", "name": "s390" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-perl-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-static-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-devel-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.ppc64", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64", "product_id": "openssl-libs-1:1.0.2k-19.el7.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=ppc64\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-static-1:1.0.2k-19.el7.ppc", "product_id": "openssl-static-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc", "product_id": "openssl-devel-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.ppc", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc", "product_id": "openssl-libs-1:1.0.2k-19.el7.ppc", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=ppc\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc" }, { "branches": [ { "category": "product_version", "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-perl@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-debuginfo@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-static-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-static-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-static@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-devel@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "product": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "product_id": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/openssl-libs@1.0.2k-19.el7?arch=ppc64le\u0026epoch=1" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Client-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)", "product_id": "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)", "product_id": "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7ComputeNode-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Server-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src" }, "product_reference": "openssl-1:1.0.2k-19.el7.src", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-devel-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-libs-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-perl-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.i686", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.s390x", "relates_to_product_reference": "7Workstation-optional-7.7" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-static-1:1.0.2k-19.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" }, "product_reference": "openssl-static-1:1.0.2k-19.el7.x86_64", "relates_to_product_reference": "7Workstation-optional-7.7" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T13:42:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2304" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2019-1559", "cwe": { "id": "CWE-325", "name": "Missing Cryptographic Step" }, "discovery_date": "2019-02-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1683804" } ], "notes": [ { "category": "description", "text": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: 0-byte record padding oracle", "title": "Vulnerability summary" }, { "category": "other", "text": "1 For this issue to be exploitable, the (server) application using the OpenSSL library needs to use it incorrectly.\n2. There are multiple other requirements for the attack to succeed: \n - The ciphersuite used must be obsolete CBC cipher without a stitched implementation (or the system be in FIPS mode)\n - the attacker has to be a MITM\n - the attacker has to be able to control the client side to send requests to the buggy server on demand", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-1559" }, { "category": "external", "summary": "RHBZ#1683804", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1683804" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-1559", "url": "https://www.cve.org/CVERecord?id=CVE-2019-1559" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1559" }, { "category": "external", "summary": "https://github.com/RUB-NDS/TLS-Padding-Oracles", "url": "https://github.com/RUB-NDS/TLS-Padding-Oracles" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20190226.txt", "url": "https://www.openssl.org/news/secadv/20190226.txt" } ], "release_date": "2019-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-08-06T13:42:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.", "product_ids": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "workaround", "details": "As a workaround you can disable SHA384 if applications (compiled with OpenSSL) allow for adjustment of the ciphersuite string configuration.", "product_ids": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Client-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Client-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7ComputeNode-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7ComputeNode-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Server-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Server-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-7.7:openssl-static-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.src", "7Workstation-optional-7.7:openssl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-debuginfo-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-devel-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-libs-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-perl-1:1.0.2k-19.el7.x86_64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.i686", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.ppc64le", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.s390x", "7Workstation-optional-7.7:openssl-static-1:1.0.2k-19.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: 0-byte record padding oracle" } ] }
RHSA-2019:3935
Vulnerability from csaf_redhat
Published
2019-11-20 16:08
Modified
2025-07-09 04:58
Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release
Notes
Topic
Red Hat JBoss Core Services Pack Apache Server 2.4.37 zip release
for RHEL 6, RHEL 7 and Microsoft Windows is available.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.
This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat JBoss Core Services Pack Apache Server 2.4.37 zip release\nfor RHEL 6, RHEL 7 and Microsoft Windows is available.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.\n\nThis release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3935", "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "JBCS-798", "url": "https://issues.redhat.com/browse/JBCS-798" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3935.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release", "tracking": { "current_release_date": "2025-07-09T04:58:41+00:00", "generator": { "date": "2025-07-09T04:58:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2019:3935", "initial_release_date": "2019-11-20T16:08:18+00:00", "revision_history": [ { "date": "2019-11-20T16:08:18+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-01-06T13:01:52+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-09T04:58:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Text-Only JBCS", "product": { "name": "Text-Only JBCS", "product_id": "Text-Only JBCS", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0737", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568253" } ], "notes": [ { "category": "description", "text": "OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0737" }, { "category": "external", "summary": "RHBZ#1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2018/04/16/3", "url": "http://www.openwall.com/lists/oss-security/2018/04/16/3" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20180416.txt", "url": "https://www.openssl.org/news/secadv/20180416.txt" } ], "release_date": "2018-04-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys" }, { "acknowledgments": [ { "names": [ "Alejandro Cabrera Aldaya" ], "organization": "Universidad Tecnologica de la Habana CUJAE; Cuba" }, { "names": [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan" ] }, { "names": [ "Nicola Tuveri" ], "organization": "Tampere University of Technology; Finland" } ], "cve": "CVE-2018-5407", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1645695" } ], "notes": [ { "category": "description", "text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", "title": "Vulnerability summary" }, { "category": "other", "text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5407" }, { "category": "external", "summary": "RHBZ#1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407" }, { "category": "external", "summary": "https://github.com/bbbrumley/portsmash", "url": "https://github.com/bbbrumley/portsmash" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20181112.txt", "url": "https://www.openssl.org/news/secadv/20181112.txt" } ], "release_date": "2018-10-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)" }, { "cve": "CVE-2018-17189", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668497" } ], "notes": [ { "category": "description", "text": "In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: DoS via slow, unneeded request bodies", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17189" }, { "category": "external", "summary": "RHBZ#1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17189", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17189" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: DoS via slow, unneeded request bodies" }, { "cve": "CVE-2018-17199", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668493" } ], "notes": [ { "category": "description", "text": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_session_cookie does not respect expiry time", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17199" }, { "category": "external", "summary": "RHBZ#1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17199", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17199" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_session_cookie does not respect expiry time" }, { "cve": "CVE-2019-0196", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695030" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: read-after-free on a string compare", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0196" }, { "category": "external", "summary": "RHBZ#1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0196", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0196" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: read-after-free on a string compare" }, { "cve": "CVE-2019-0197", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695042" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: possible crash on late upgrade", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0197" }, { "category": "external", "summary": "RHBZ#1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0197", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0197" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-02-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: possible crash on late upgrade" }, { "cve": "CVE-2019-0217", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695020" } ], "notes": [ { "category": "description", "text": "A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_auth_digest: access control bypass due to race condition", "title": "Vulnerability summary" }, { "category": "other", "text": "Based on the the fact that digest authentication is rarely used in modern day web applications and httpd package shipped with Red Hat products do not ship threaded MPM configuration by default, this flaw has been rated as having Moderate level security impact. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0217" }, { "category": "external", "summary": "RHBZ#1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0217", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "This flaw only affects a threaded server configuration, so using the prefork MPM is an effective mitigation. In versions of httpd package shipped with Red Hat Enterprise Linux 7, the prefork MPM is the default configuration.", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_auth_digest: access control bypass due to race condition" }, { "cve": "CVE-2019-9511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741860" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: large amount of data requests leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "There are no mitigations available for nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9511" }, { "category": "external", "summary": "RHBZ#1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9511", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: large amount of data requests leads to denial of service" }, { "acknowledgments": [ { "names": [ "the Envoy security team" ] } ], "cve": "CVE-2019-9513", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1735741" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for packages nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9513" }, { "category": "external", "summary": "RHBZ#1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9513", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9513" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/", "url": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption" }, { "cve": "CVE-2019-9516", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741864" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: 0-length headers lead to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9516" }, { "category": "external", "summary": "RHBZ#1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9516", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9516" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://github.com/nghttp2/nghttp2/issues/1382#", "url": "https://github.com/nghttp2/nghttp2/issues/1382#" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: 0-length headers lead to denial of service" }, { "cve": "CVE-2019-9517", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741868" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server\u0027s queue is setup, the responses can consume excess memory, CPU, or both, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: request for large response leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "The package httpd versions as shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this issue as HTTP/2 support is not provided.\nThis flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Text-Only JBCS" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9517" }, { "category": "external", "summary": "RHBZ#1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9517", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:08:18+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Text-Only JBCS" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "workaround", "details": "The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps:\n\n1. Stop httpd service:\n$ systemctl stop httpd\n\n2. Remove http/2 protocol support from configuration files:\n$ sed -i \u0027s/\\(h2\\)\\|\\(h2c\\)//g\u0027 \u003chttpd_config_file\u003e\n\n3. Validate configuration files to make sure all syntax is valid:\n$ apachectl configtest\n\n4. Restart httpd service:\n$ systemctl start httpd", "product_ids": [ "Text-Only JBCS" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "Text-Only JBCS" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: request for large response leads to denial of service" } ] }
RHSA-2019:3932
Vulnerability from csaf_redhat
Published
2019-11-20 16:22
Modified
2025-07-09 04:58
Summary
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6
Notes
Topic
Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.
This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering.\n\nThis release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:3932", "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "JBCS-798", "url": "https://issues.redhat.com/browse/JBCS-798" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3932.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6", "tracking": { "current_release_date": "2025-07-09T04:58:58+00:00", "generator": { "date": "2025-07-09T04:58:58+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2019:3932", "initial_release_date": "2019-11-20T16:22:09+00:00", "revision_history": [ { "date": "2019-11-20T16:22:09+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-01-06T13:05:52+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-09T04:58:58+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Core Services on RHEL 6 Server", "product": { "name": "Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_core_services:1::el6" } } } ], "category": "product_family", "name": "Red Hat JBoss Core Services" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "product_id": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-devel@2.11-20.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "product_id": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-debuginfo@2.11-20.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-63.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-63.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1-25.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-devel@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-ldap@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-mysql@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-nss@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-odbc@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-openssl@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-pgsql@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-sqlite@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "product_id": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-debuginfo@1.6.1-48.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-7.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-7.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "product_id": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-devel@1.39.2-4.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "product_id": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-debuginfo@1.39.2-4.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl-devel@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "product_id": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl-debuginfo@7.64.1-14.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-33.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-33.jbcs.el6?arch=i686\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-33.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-9.Final_redhat_2.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.46-22.redhat_1.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-manual@1.2.46-22.redhat_1.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-debuginfo@1.2.46-22.redhat_1.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el6?arch=i686" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "product": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.2-16.GA.jbcs.el6?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-devel@2.11-20.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson-debuginfo@2.11-20.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-devel@1.6.3-63.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-debuginfo@1.6.3-63.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.1.1-25.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-devel@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-ldap@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-mysql@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-nss@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-odbc@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-openssl@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-pgsql@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-sqlite@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util-debuginfo@1.6.1-48.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-devel@1.0.6-7.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli-debuginfo@1.0.6-7.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-devel@1.39.2-4.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2-debuginfo@1.39.2-4.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-libcurl-devel@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl-debuginfo@7.64.1-14.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_md@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.37-33.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.37-33.jbcs.el6?arch=x86_64\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.37-33.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native-debuginfo@1.3.12-9.Final_redhat_2.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-ap24@1.2.46-22.redhat_1.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-manual@1.2.46-22.redhat_1.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk-debuginfo@1.2.46-22.redhat_1.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el6?arch=x86_64" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "product": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.2-16.GA.jbcs.el6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "product": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "product_id": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-jansson@2.11-20.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "product": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "product_id": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr@1.6.3-63.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "product": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "product_id": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.1.1-25.jbcs.el6?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "product": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "product_id": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-apr-util@1.6.1-48.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "product": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "product_id": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-brotli@1.0.6-7.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "product": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "product_id": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-nghttp2@1.39.2-4.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "product": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "product_id": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-curl@7.64.1-14.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "product": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "product_id": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.37-33.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_cluster-native@1.3.12-9.Final_redhat_2.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_jk@1.2.46-22.redhat_1.jbcs.el6?arch=src" } } }, { "category": "product_version", "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "product": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "product_id": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.2-16.GA.jbcs.el6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "product": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "product_id": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.37-33.jbcs.el6?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch" }, "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "relates_to_product_reference": "6Server-JBCS" }, { "category": "default_component_of", "full_product_name": { "name": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server", "product_id": "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" }, "product_reference": "jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64", "relates_to_product_reference": "6Server-JBCS" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-10-30T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1644364" } ], "notes": [ { "category": "description", "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: timing side channel attack in the DSA signature algorithm", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0734" }, { "category": "external", "summary": "RHBZ#1644364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1644364" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0734", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0734" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0734" } ], "release_date": "2018-10-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: timing side channel attack in the DSA signature algorithm" }, { "cve": "CVE-2018-0737", "cwe": { "id": "CWE-385", "name": "Covert Timing Channel" }, "discovery_date": "2018-04-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1568253" } ], "notes": [ { "category": "description", "text": "OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-0737" }, { "category": "external", "summary": "RHBZ#1568253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1568253" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-0737", "url": "https://www.cve.org/CVERecord?id=CVE-2018-0737" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0737" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2018/04/16/3", "url": "http://www.openwall.com/lists/oss-security/2018/04/16/3" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20180416.txt", "url": "https://www.openssl.org/news/secadv/20180416.txt" } ], "release_date": "2018-04-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys" }, { "acknowledgments": [ { "names": [ "Alejandro Cabrera Aldaya" ], "organization": "Universidad Tecnologica de la Habana CUJAE; Cuba" }, { "names": [ "Billy Bob Brumley", "Cesar Pereida Garcia", "Sohaib ul Hassan" ] }, { "names": [ "Nicola Tuveri" ], "organization": "Tampere University of Technology; Finland" } ], "cve": "CVE-2018-5407", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2018-11-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1645695" } ], "notes": [ { "category": "description", "text": "A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.", "title": "Vulnerability description" }, { "category": "summary", "text": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)", "title": "Vulnerability summary" }, { "category": "other", "text": "This is a timing side-channel flaw on processors which implement SMT/Hyper-Threading architectures. It can result in leakage of secret data in applications such as OpenSSL that has secret dependent control flow at any granularity level. In order to exploit this flaw, the attacker needs to run a malicious process on the same core of the processor as the victim process.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-5407" }, { "category": "external", "summary": "RHBZ#1645695", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1645695" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5407", "url": "https://www.cve.org/CVERecord?id=CVE-2018-5407" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5407" }, { "category": "external", "summary": "https://github.com/bbbrumley/portsmash", "url": "https://github.com/bbbrumley/portsmash" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20181112.txt", "url": "https://www.openssl.org/news/secadv/20181112.txt" } ], "release_date": "2018-10-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: https://access.redhat.com/security/vulnerabilities/L1TF and decide what their exposure across shared CPU threads are and act accordingly.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)" }, { "cve": "CVE-2018-17189", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668497" } ], "notes": [ { "category": "description", "text": "In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: DoS via slow, unneeded request bodies", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17189" }, { "category": "external", "summary": "RHBZ#1668497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668497" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17189", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17189" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17189" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: DoS via slow, unneeded request bodies" }, { "cve": "CVE-2018-17199", "cwe": { "id": "CWE-613", "name": "Insufficient Session Expiration" }, "discovery_date": "2019-01-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668493" } ], "notes": [ { "category": "description", "text": "In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_session_cookie does not respect expiry time", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-17199" }, { "category": "external", "summary": "RHBZ#1668493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668493" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-17199", "url": "https://www.cve.org/CVERecord?id=CVE-2018-17199" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17199" } ], "release_date": "2019-01-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_session_cookie does not respect expiry time" }, { "cve": "CVE-2019-0196", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695030" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: read-after-free on a string compare", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0196" }, { "category": "external", "summary": "RHBZ#1695030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695030" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0196", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0196" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0196" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: read-after-free on a string compare" }, { "cve": "CVE-2019-0197", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695042" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_http2: possible crash on late upgrade", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0197" }, { "category": "external", "summary": "RHBZ#1695042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695042" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0197", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0197" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0197" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-02-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "httpd: mod_http2: possible crash on late upgrade" }, { "cve": "CVE-2019-0217", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695020" } ], "notes": [ { "category": "description", "text": "A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.", "title": "Vulnerability description" }, { "category": "summary", "text": "httpd: mod_auth_digest: access control bypass due to race condition", "title": "Vulnerability summary" }, { "category": "other", "text": "Based on the the fact that digest authentication is rarely used in modern day web applications and httpd package shipped with Red Hat products do not ship threaded MPM configuration by default, this flaw has been rated as having Moderate level security impact. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-0217" }, { "category": "external", "summary": "RHBZ#1695020", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695020" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-0217", "url": "https://www.cve.org/CVERecord?id=CVE-2019-0217" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0217" }, { "category": "external", "summary": "http://www.apache.org/dist/httpd/CHANGES_2.4", "url": "http://www.apache.org/dist/httpd/CHANGES_2.4" }, { "category": "external", "summary": "https://httpd.apache.org/security/vulnerabilities_24.html", "url": "https://httpd.apache.org/security/vulnerabilities_24.html" } ], "release_date": "2019-04-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "This flaw only affects a threaded server configuration, so using the prefork MPM is an effective mitigation. In versions of httpd package shipped with Red Hat Enterprise Linux 7, the prefork MPM is the default configuration.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "httpd: mod_auth_digest: access control bypass due to race condition" }, { "cve": "CVE-2019-9511", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741860" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: large amount of data requests leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "There are no mitigations available for nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9511" }, { "category": "external", "summary": "RHBZ#1741860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741860" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9511", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: large amount of data requests leads to denial of service" }, { "acknowledgments": [ { "names": [ "the Envoy security team" ] } ], "cve": "CVE-2019-9513", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1735741" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for packages nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9513" }, { "category": "external", "summary": "RHBZ#1735741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1735741" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9513", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9513" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/", "url": "https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T17:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: flood using PRIORITY frames results in excessive resource consumption" }, { "cve": "CVE-2019-9516", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741864" } ], "notes": [ { "category": "description", "text": "A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: 0-length headers lead to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9516" }, { "category": "external", "summary": "RHBZ#1741864", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741864" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9516", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9516" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9516" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://github.com/nghttp2/nghttp2/issues/1382#", "url": "https://github.com/nghttp2/nghttp2/issues/1382#" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" }, { "category": "external", "summary": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/", "url": "https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions:\n\n1. Copy the Nginx configuration from the quay container to the host\n$ docker cp 3aadf1421ba3:/quay-registry/conf/nginx/ /mnt/quay/nginx\n\n2. Edit the Nginx configuration, removing http/2 support\n$ sed -i \u0027s/http2 //g\u0027 /mnt/quay/nginx/nginx.conf\n\n3. Restart Nginx with the new configuration mounted into the container, eg:\n$ docker run --restart=always -p 443:8443 -p 80:8080 --sysctl net.core.somaxconn=4096 -v /mnt/quay/config:/conf/stack:Z -v /mnt/quay/storage:/datastorage -v /mnt/quay/nginx:/quay-registry/config/nginx:Z -d quay.io/redhat/quay:v3.0.3", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: 0-length headers lead to denial of service" }, { "cve": "CVE-2019-9517", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-08-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1741868" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in HTTP/2. An attacker can open a HTTP/2 window so the peer can send without constraint. The TCP window remains closed so the peer cannot write the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the server\u0027s queue is setup, the responses can consume excess memory, CPU, or both, potentially leading to a denial of service. The highest threat from this vulnerability is to system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "HTTP/2: request for large response leads to denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "The package httpd versions as shipped with Red Hat Enterprise Linux 5, 6 and 7 are not affected by this issue as HTTP/2 support is not provided.\nThis flaw has no available mitigation for nodejs package. It will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Collections.\n\nThe nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is not affected by this flaw as it does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9517" }, { "category": "external", "summary": "RHBZ#1741868", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741868" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9517", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9517" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517" }, { "category": "external", "summary": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md", "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md" }, { "category": "external", "summary": "https://kb.cert.org/vuls/id/605641/", "url": "https://kb.cert.org/vuls/id/605641/" }, { "category": "external", "summary": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "url": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/" } ], "release_date": "2019-08-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-11-20T16:22:09+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "workaround", "details": "The httpd version shipped with Red Hat Enterprise Linux 8 provides HTTP/2 support through mod_http2 package. While mod_http2 package is not updated, users can disable HTTP/2 support as mitigation action by executing the following steps:\n\n1. Stop httpd service:\n$ systemctl stop httpd\n\n2. Remove http/2 protocol support from configuration files:\n$ sed -i \u0027s/\\(h2\\)\\|\\(h2c\\)//g\u0027 \u003chttpd_config_file\u003e\n\n3. Validate configuration files to make sure all syntax is valid:\n$ apachectl configtest\n\n4. Restart httpd service:\n$ systemctl start httpd", "product_ids": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-debuginfo-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-devel-0:1.6.3-63.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-debuginfo-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-devel-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-ldap-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-mysql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-nss-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-odbc-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-openssl-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-pgsql-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-apr-util-sqlite-0:1.6.1-48.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-debuginfo-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-brotli-devel-0:1.0.6-7.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-curl-debuginfo-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.37-33.jbcs.el6.noarch", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-jansson-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-debuginfo-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-jansson-devel-0:2.11-20.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-libcurl-devel-0:7.64.1-14.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_cluster-native-debuginfo-0:1.3.12-9.Final_redhat_2.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-ap24-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-debuginfo-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_jk-manual-0:1.2.46-22.redhat_1.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_md-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.2-16.GA.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.37-33.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-debuginfo-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-nghttp2-devel-0:1.39.2-4.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.src", "6Server-JBCS:jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.1.1-25.jbcs.el6.x86_64", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.i686", "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.1.1-25.jbcs.el6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "HTTP/2: request for large response leads to denial of service" } ] }
wid-sec-w-2023-1594
Vulnerability from csaf_certbund
Published
2023-06-28 22:00
Modified
2023-06-28 22:00
Summary
IBM Tivoli Network Manager: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
IBM Tivoli Network Manager ist eine Netzanalysesoftware für das Management komplexer Netze. Diese Software erfasst und verteilt Layer-2- und Layer-3-Netzdaten.
Angriff
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuführen, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuführen.
Betroffene Betriebssysteme
- UNIX
- Linux
- Windows
- Sonstiges
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM Tivoli Network Manager ist eine Netzanalysesoftware f\u00fcr das Management komplexer Netze. Diese Software erfasst und verteilt Layer-2- und Layer-3-Netzdaten.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- UNIX\n- Linux\n- Windows\n- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-1594 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-1594.json" }, { "category": "self", "summary": "WID-SEC-2023-1594 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1594" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/885316" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/884276" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/883428" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/883424" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/882926" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/882898" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/882888" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/880403" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/880401" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/880395" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/879855" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/879841" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/870546" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/870526" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/870508" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/870504" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/870500" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/870498" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/743933" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/739297" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/739271" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/739249" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/739247" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/739245" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/739243" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/738231" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/731931" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/730883" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/730871" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/730845" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/730835" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/730171" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/720307" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/720283" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/720265" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/718745" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/717345" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/717335" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/717327" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/717007" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/716573" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/712213" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/712199" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/570557" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/569765" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/569727" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/569717" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/305321" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/304091" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/304089" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/303663" }, { "category": "external", "summary": "IBM Security Advisory vom 2023-06-28", "url": "https://www.ibm.com/support/pages/node/303657" } ], "source_lang": "en-US", "title": "IBM Tivoli Network Manager: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-06-28T22:00:00.000+00:00", "generator": { "date": "2024-08-15T17:53:31.776+00:00", "engine": { "name": "BSI-WID", "version": "1.3.5" } }, "id": "WID-SEC-W-2023-1594", "initial_release_date": "2023-06-28T22:00:00.000+00:00", "revision_history": [ { "date": "2023-06-28T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "IBM Tivoli Network Manager IP Edition \u003c 3.9 Fix Pack 5", "product": { "name": "IBM Tivoli Network Manager IP Edition \u003c 3.9 Fix Pack 5", "product_id": "T028343", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition__3.9_fix_pack_5" } } }, { "category": "product_name", "name": "IBM Tivoli Network Manager IP Edition \u003c 3.9", "product": { "name": "IBM Tivoli Network Manager IP Edition \u003c 3.9", "product_id": "T028344", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition__3.9" } } }, { "category": "product_name", "name": "IBM Tivoli Network Manager IP Edition \u003c 4.1.1", "product": { "name": "IBM Tivoli Network Manager IP Edition \u003c 4.1.1", "product_id": "T028345", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition__4.1.1" } } }, { "category": "product_name", "name": "IBM Tivoli Network Manager IP Edition \u003c 4.2", "product": { "name": "IBM Tivoli Network Manager IP Edition \u003c 4.2", "product_id": "T028346", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition__4.2" } } }, { "category": "product_name", "name": "IBM Tivoli Network Manager IP Edition \u003c 3.9.0.4", "product": { "name": "IBM Tivoli Network Manager IP Edition \u003c 3.9.0.4", "product_id": "T028347", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition__3.9.0.4" } } }, { "category": "product_name", "name": "IBM Tivoli Network Manager IP Edition \u003c 3.9.0.5", "product": { "name": "IBM Tivoli Network Manager IP Edition \u003c 3.9.0.5", "product_id": "T028348", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition__3.9.0.5" } } }, { "category": "product_name", "name": "IBM Tivoli Network Manager IP Edition \u003c 3.9 Fix Pack 4", "product": { "name": "IBM Tivoli Network Manager IP Edition \u003c 3.9 Fix Pack 4", "product_id": "T028349", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition__3.9_fix_pack_4" } } } ], "category": "product_name", "name": "Tivoli Network Manager" } ], "category": "vendor", "name": "IBM" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-4046", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-4046" }, { "cve": "CVE-2019-4030", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-4030" }, { "cve": "CVE-2019-2684", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-2684" }, { "cve": "CVE-2019-2602", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-2602" }, { "cve": "CVE-2019-2537", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-2537" }, { "cve": "CVE-2019-2534", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-2534" }, { "cve": "CVE-2019-2531", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-2531" }, { "cve": "CVE-2019-2529", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-2529" }, { "cve": "CVE-2019-2503", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-2503" }, { "cve": "CVE-2019-2482", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-2482" }, { "cve": "CVE-2019-2481", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-2481" }, { "cve": "CVE-2019-2455", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-2455" }, { "cve": "CVE-2019-1559", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-1559" }, { "cve": "CVE-2019-0220", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2019-0220" }, { "cve": "CVE-2018-8039", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-8039" }, { "cve": "CVE-2018-5407", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-5407" }, { "cve": "CVE-2018-3282", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3282" }, { "cve": "CVE-2018-3278", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3278" }, { "cve": "CVE-2018-3276", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3276" }, { "cve": "CVE-2018-3251", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3251" }, { "cve": "CVE-2018-3247", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3247" }, { "cve": "CVE-2018-3174", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3174" }, { "cve": "CVE-2018-3156", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3156" }, { "cve": "CVE-2018-3143", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3143" }, { "cve": "CVE-2018-3123", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3123" }, { "cve": "CVE-2018-3084", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3084" }, { "cve": "CVE-2018-3082", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3082" }, { "cve": "CVE-2018-3081", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3081" }, { "cve": "CVE-2018-3080", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3080" }, { "cve": "CVE-2018-3079", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3079" }, { "cve": "CVE-2018-3078", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3078" }, { "cve": "CVE-2018-3077", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3077" }, { "cve": "CVE-2018-3075", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3075" }, { "cve": "CVE-2018-3074", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3074" }, { "cve": "CVE-2018-3073", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3073" }, { "cve": "CVE-2018-3071", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3071" }, { "cve": "CVE-2018-3070", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3070" }, { "cve": "CVE-2018-3067", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3067" }, { "cve": "CVE-2018-3066", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3066" }, { "cve": "CVE-2018-3065", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3065" }, { "cve": "CVE-2018-3064", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3064" }, { "cve": "CVE-2018-3063", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3063" }, { "cve": "CVE-2018-3062", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3062" }, { "cve": "CVE-2018-3061", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3061" }, { "cve": "CVE-2018-3060", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3060" }, { "cve": "CVE-2018-3058", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3058" }, { "cve": "CVE-2018-3056", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3056" }, { "cve": "CVE-2018-3054", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-3054" }, { "cve": "CVE-2018-2877", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2877" }, { "cve": "CVE-2018-2846", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2846" }, { "cve": "CVE-2018-2839", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2839" }, { "cve": "CVE-2018-2819", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2819" }, { "cve": "CVE-2018-2818", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2818" }, { "cve": "CVE-2018-2817", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2817" }, { "cve": "CVE-2018-2816", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2816" }, { "cve": "CVE-2018-2813", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2813" }, { "cve": "CVE-2018-2812", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2812" }, { "cve": "CVE-2018-2810", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2810" }, { "cve": "CVE-2018-2805", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2805" }, { "cve": "CVE-2018-2787", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2787" }, { "cve": "CVE-2018-2786", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2786" }, { "cve": "CVE-2018-2784", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2784" }, { "cve": "CVE-2018-2782", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2782" }, { "cve": "CVE-2018-2781", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2781" }, { "cve": "CVE-2018-2780", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2780" }, { "cve": "CVE-2018-2779", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2779" }, { "cve": "CVE-2018-2778", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2778" }, { "cve": "CVE-2018-2777", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2777" }, { "cve": "CVE-2018-2776", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2776" }, { "cve": "CVE-2018-2775", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2775" }, { "cve": "CVE-2018-2773", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2773" }, { "cve": "CVE-2018-2771", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2771" }, { "cve": "CVE-2018-2769", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2769" }, { "cve": "CVE-2018-2766", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2766" }, { "cve": "CVE-2018-2762", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2762" }, { "cve": "CVE-2018-2761", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2761" }, { "cve": "CVE-2018-2759", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2759" }, { "cve": "CVE-2018-2758", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2758" }, { "cve": "CVE-2018-2755", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2755" }, { "cve": "CVE-2018-2598", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-2598" }, { "cve": "CVE-2018-1996", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1996" }, { "cve": "CVE-2018-1926", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1926" }, { "cve": "CVE-2018-1904", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1904" }, { "cve": "CVE-2018-1902", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1902" }, { "cve": "CVE-2018-1901", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1901" }, { "cve": "CVE-2018-1798", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1798" }, { "cve": "CVE-2018-1797", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1797" }, { "cve": "CVE-2018-1794", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1794" }, { "cve": "CVE-2018-1793", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1793" }, { "cve": "CVE-2018-1777", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1777" }, { "cve": "CVE-2018-1770", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1770" }, { "cve": "CVE-2018-1767", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1767" }, { "cve": "CVE-2018-1719", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1719" }, { "cve": "CVE-2018-1695", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1695" }, { "cve": "CVE-2018-1656", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1656" }, { "cve": "CVE-2018-1643", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1643" }, { "cve": "CVE-2018-1621", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1621" }, { "cve": "CVE-2018-1614", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1614" }, { "cve": "CVE-2018-1567", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1567" }, { "cve": "CVE-2018-1447", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1447" }, { "cve": "CVE-2018-1428", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1428" }, { "cve": "CVE-2018-1427", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1427" }, { "cve": "CVE-2018-1426", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1426" }, { "cve": "CVE-2018-1301", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-1301" }, { "cve": "CVE-2018-12539", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-12539" }, { "cve": "CVE-2018-10237", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-10237" }, { "cve": "CVE-2018-0734", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-0734" }, { "cve": "CVE-2018-0732", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2018-0732" }, { "cve": "CVE-2017-9798", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-9798" }, { "cve": "CVE-2017-3738", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-3738" }, { "cve": "CVE-2017-3737", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-3737" }, { "cve": "CVE-2017-3736", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-3736" }, { "cve": "CVE-2017-3735", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-3735" }, { "cve": "CVE-2017-3732", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-3732" }, { "cve": "CVE-2017-1743", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-1743" }, { "cve": "CVE-2017-1741", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-1741" }, { "cve": "CVE-2017-1731", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-1731" }, { "cve": "CVE-2017-1681", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-1681" }, { "cve": "CVE-2017-15715", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-15715" }, { "cve": "CVE-2017-15710", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-15710" }, { "cve": "CVE-2017-12624", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-12624" }, { "cve": "CVE-2017-12618", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-12618" }, { "cve": "CVE-2017-12613", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2017-12613" }, { "cve": "CVE-2016-0705", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2016-0705" }, { "cve": "CVE-2016-0702", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2016-0702" }, { "cve": "CVE-2016-0701", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2016-0701" }, { "cve": "CVE-2015-0899", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2015-0899" }, { "cve": "CVE-2014-7810", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2014-7810" }, { "cve": "CVE-2012-5783", "notes": [ { "category": "description", "text": "In IBM Tivoli Network Manager existieren mehrere Schwachstellen. Die Fehler bestehen unter anderem in den Komponenten OpenSSL, Apache CXF, Apache HTTPD, Oracle MySQL, Apache Commons, Apache Struts, IBM GSKit, Java SDK, Eclipse OpenJ9 und SAML. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, seine Privilegien auszuweiten, Daten zu manipulieren, nicht spezifizierte Auswirkungen zu verursachen und einen Cross-Site-Scripting-Angriff durchzuf\u00fchren. Die erfolgreiche Ausnutzung einiger dieser Schwachstellen erfordert eine Benutzerinteraktion oder erh\u00f6hte Berechtigungen." } ], "release_date": "2023-06-28T22:00:00.000+00:00", "title": "CVE-2012-5783" } ] }
wid-sec-w-2023-3083
Vulnerability from csaf_certbund
Published
2018-10-29 23:00
Modified
2024-11-25 23:00
Summary
OpenSSL: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
OpenSSL ist eine im Quelltext frei verfügbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
Betroffene Betriebssysteme
- Linux
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "OpenSSL ist eine im Quelltext frei verf\u00fcgbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Sicherheitsvorkehrungen zu umgehen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-3083 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2018/wid-sec-w-2023-3083.json" }, { "category": "self", "summary": "WID-SEC-2023-3083 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3083" }, { "category": "external", "summary": "OpenSSL Security Advisory vom 2018-10-29", "url": "http://www.openssl.org/news/secadv/20181030.txt" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3866-1 vom 2018-11-23", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183866-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3864-1 vom 2018-11-23", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183864-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3863-1 vom 2018-11-23", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183863-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3945-1 vom 2018-11-30", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183945-1.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-4348 vom 2018-12-01", "url": "https://www.debian.org/security/2018/dsa-4348" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3964-1 vom 2018-12-04", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183964-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3989-1 vom 2018-12-06", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183989-1.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-3840-1 vom 2018-12-07", "url": "http://www.ubuntu.com/usn/usn-3840-1" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:4001-1 vom 2018-12-07", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20184001-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:4068-1 vom 2018-12-11", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20184068-1.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-4355 vom 2018-12-20", "url": "https://www.debian.org/security/2018/dsa-4355" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:4274-1 vom 2018-12-27", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20184274-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:0117-1 vom 2019-01-18", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20190117-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3864-2 vom 2019-04-28", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20183864-2.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:1553-1 vom 2019-06-19", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191553-1.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:2304 vom 2019-08-06", "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2019-4754 vom 2019-08-19", "url": "http://linux.oracle.com/errata/ELSA-2019-4754.html" }, { "category": "external", "summary": "Symantec Security Advisory SYMSA1490 vom 2019-09-06", "url": "https://support.symantec.com/us/en/article.SYMSA1490.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:3700 vom 2019-11-05", "url": "https://access.redhat.com/errata/RHSA-2019:3700" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:3935 vom 2019-11-20", "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:3933 vom 2019-11-20", "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:3932 vom 2019-11-20", "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2021-9121 vom 2021-04-06", "url": "https://linux.oracle.com/errata/ELSA-2021-9121.html" }, { "category": "external", "summary": "Dell Knowledge Base Article", "url": "https://www.dell.com/support/kbdoc/en-us/000221474/dsa-2024-059-security-update-for-dell-networker-multiple-components-vulnerabilities" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-13025 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-13025.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-13026 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-13026.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-13027 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-13027.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-32791 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-32791.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12842 vom 2024-11-25", "url": "https://linux.oracle.com/errata/ELSA-2024-12842.html" } ], "source_lang": "en-US", "title": "OpenSSL: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen", "tracking": { "current_release_date": "2024-11-25T23:00:00.000+00:00", "generator": { "date": "2024-11-26T09:25:03.807+00:00", "engine": { "name": "BSI-WID", "version": "1.3.8" } }, "id": "WID-SEC-W-2023-3083", "initial_release_date": "2018-10-29T23:00:00.000+00:00", "revision_history": [ { "date": "2018-10-29T23:00:00.000+00:00", "number": "1", "summary": "Initial Release" }, { "date": "2018-11-05T23:00:00.000+00:00", "number": "2", "summary": "Added references" }, { "date": "2018-11-07T23:00:00.000+00:00", "number": "3", "summary": "Produkt erg\u00e4nzt" }, { "date": "2018-11-22T23:00:00.000+00:00", "number": "4", "summary": "New remediations available" }, { "date": "2018-11-29T23:00:00.000+00:00", "number": "5", "summary": "New remediations available" }, { "date": "2018-12-02T23:00:00.000+00:00", "number": "6", "summary": "New remediations available" }, { "date": "2018-12-03T23:00:00.000+00:00", "number": "7", "summary": "New remediations available" }, { "date": "2018-12-05T23:00:00.000+00:00", "number": "8", "summary": "New remediations available" }, { "date": "2018-12-06T23:00:00.000+00:00", "number": "9", "summary": "New remediations available" }, { "date": "2018-12-09T23:00:00.000+00:00", "number": "10", "summary": "New remediations available" }, { "date": "2018-12-11T23:00:00.000+00:00", "number": "11", "summary": "New remediations available" }, { "date": "2018-12-19T23:00:00.000+00:00", "number": "12", "summary": "New remediations available" }, { "date": "2018-12-27T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2019-01-15T23:00:00.000+00:00", "number": "14", "summary": "Referenz(en) aufgenommen: FEDORA-2019-A8FFCFF7EE" }, { "date": "2019-01-20T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2019-04-28T22:00:00.000+00:00", "number": "16", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2019-06-18T22:00:00.000+00:00", "number": "17", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2019-08-06T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2019-08-19T22:00:00.000+00:00", "number": "19", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2019-09-05T22:00:00.000+00:00", "number": "20", "summary": "Neue Updates von Symantec aufgenommen" }, { "date": "2019-09-10T22:00:00.000+00:00", "number": "21", "summary": "Referenz(en) aufgenommen: FEDORA-2019-9A0A7C0986, FEDORA-2019-00C25B9379" }, { "date": "2019-09-11T22:00:00.000+00:00", "number": "22", "summary": "Referenz(en) aufgenommen: FEDORA-2019-DB06EFDEA1" }, { "date": "2019-11-05T23:00:00.000+00:00", "number": "23", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2019-11-20T23:00:00.000+00:00", "number": "24", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2021-04-06T22:00:00.000+00:00", "number": "25", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2023-12-07T23:00:00.000+00:00", "number": "26", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-01-25T23:00:00.000+00:00", "number": "27", "summary": "Neue Updates von Dell aufgenommen" }, { "date": "2024-11-25T23:00:00.000+00:00", "number": "28", "summary": "Neue Updates von Oracle Linux aufgenommen" } ], "status": "final", "version": "28" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c19.10", "product": { "name": "Dell NetWorker \u003c19.10", "product_id": "T032354" } }, { "category": "product_version", "name": "19.1", "product": { "name": "Dell NetWorker 19.10", "product_id": "T032354-fixed", "product_identification_helper": { "cpe": "cpe:/a:dell:networker:19.10" } } } ], "category": "product_name", "name": "NetWorker" } ], "category": "vendor", "name": "Dell" }, { "branches": [ { "category": "product_name", "name": "NetApp OnCommand Unified Manager", "product": { "name": "NetApp OnCommand Unified Manager", "product_id": "T009408", "product_identification_helper": { "cpe": "cpe:/a:netapp:oncommand_unified_manager:-" } } } ], "category": "vendor", "name": "NetApp" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "1.1.1a", "product": { "name": "Open Source OpenSSL 1.1.1a", "product_id": "T013003", "product_identification_helper": { "cpe": "cpe:/a:openssl:openssl:1.1.1a" } } }, { "category": "product_version", "name": "1.1.0j", "product": { "name": "Open Source OpenSSL 1.1.0j", "product_id": "T013004", "product_identification_helper": { "cpe": "cpe:/a:openssl:openssl:1.1.0j" } } }, { "category": "product_version", "name": "1.0.2q", "product": { "name": "Open Source OpenSSL 1.0.2q", "product_id": "T013009", "product_identification_helper": { "cpe": "cpe:/a:openssl:openssl:1.0.2q" } } } ], "category": "product_name", "name": "OpenSSL" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-0734", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in OpenSSL. Der OpenSSL DSA-Signaturalgorithmus ist anf\u00e4llig f\u00fcr einen Timing-Seitenkanalangriff. Ein Angreifer kann Variationen im Signaturalgorithmus verwenden, um den privaten Schl\u00fcssel offenzulegen." } ], "product_status": { "known_affected": [ "2951", "T002207", "T009408", "67646", "T013009", "T000126", "T013004", "T013003", "T004914", "T032354" ] }, "release_date": "2018-10-29T23:00:00.000+00:00", "title": "CVE-2018-0734" } ] }
WID-SEC-W-2023-3083
Vulnerability from csaf_certbund
Published
2018-10-29 23:00
Modified
2024-11-25 23:00
Summary
OpenSSL: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
OpenSSL ist eine im Quelltext frei verfügbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
Betroffene Betriebssysteme
- Linux
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "OpenSSL ist eine im Quelltext frei verf\u00fcgbare Bibliothek, die Secure Sockets Layer (SSL) und Transport Layer Security (TLS) implementiert.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Sicherheitsvorkehrungen zu umgehen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-3083 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2018/wid-sec-w-2023-3083.json" }, { "category": "self", "summary": "WID-SEC-2023-3083 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3083" }, { "category": "external", "summary": "OpenSSL Security Advisory vom 2018-10-29", "url": "http://www.openssl.org/news/secadv/20181030.txt" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3866-1 vom 2018-11-23", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183866-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3864-1 vom 2018-11-23", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183864-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3863-1 vom 2018-11-23", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183863-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3945-1 vom 2018-11-30", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183945-1.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-4348 vom 2018-12-01", "url": "https://www.debian.org/security/2018/dsa-4348" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3964-1 vom 2018-12-04", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183964-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3989-1 vom 2018-12-06", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183989-1.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-3840-1 vom 2018-12-07", "url": "http://www.ubuntu.com/usn/usn-3840-1" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:4001-1 vom 2018-12-07", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20184001-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:4068-1 vom 2018-12-11", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20184068-1.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-4355 vom 2018-12-20", "url": "https://www.debian.org/security/2018/dsa-4355" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:4274-1 vom 2018-12-27", "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20184274-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:0117-1 vom 2019-01-18", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20190117-1.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2018:3864-2 vom 2019-04-28", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20183864-2.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2019:1553-1 vom 2019-06-19", "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20191553-1.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:2304 vom 2019-08-06", "url": "https://access.redhat.com/errata/RHSA-2019:2304" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2019-4754 vom 2019-08-19", "url": "http://linux.oracle.com/errata/ELSA-2019-4754.html" }, { "category": "external", "summary": "Symantec Security Advisory SYMSA1490 vom 2019-09-06", "url": "https://support.symantec.com/us/en/article.SYMSA1490.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:3700 vom 2019-11-05", "url": "https://access.redhat.com/errata/RHSA-2019:3700" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:3935 vom 2019-11-20", "url": "https://access.redhat.com/errata/RHSA-2019:3935" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:3933 vom 2019-11-20", "url": "https://access.redhat.com/errata/RHSA-2019:3933" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2019:3932 vom 2019-11-20", "url": "https://access.redhat.com/errata/RHSA-2019:3932" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2021-9121 vom 2021-04-06", "url": "https://linux.oracle.com/errata/ELSA-2021-9121.html" }, { "category": "external", "summary": "Dell Knowledge Base Article", "url": "https://www.dell.com/support/kbdoc/en-us/000221474/dsa-2024-059-security-update-for-dell-networker-multiple-components-vulnerabilities" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-13025 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-13025.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-13026 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-13026.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-13027 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-13027.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-32791 vom 2023-12-07", "url": "https://linux.oracle.com/errata/ELSA-2023-32791.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-12842 vom 2024-11-25", "url": "https://linux.oracle.com/errata/ELSA-2024-12842.html" } ], "source_lang": "en-US", "title": "OpenSSL: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen", "tracking": { "current_release_date": "2024-11-25T23:00:00.000+00:00", "generator": { "date": "2024-11-26T09:25:03.807+00:00", "engine": { "name": "BSI-WID", "version": "1.3.8" } }, "id": "WID-SEC-W-2023-3083", "initial_release_date": "2018-10-29T23:00:00.000+00:00", "revision_history": [ { "date": "2018-10-29T23:00:00.000+00:00", "number": "1", "summary": "Initial Release" }, { "date": "2018-11-05T23:00:00.000+00:00", "number": "2", "summary": "Added references" }, { "date": "2018-11-07T23:00:00.000+00:00", "number": "3", "summary": "Produkt erg\u00e4nzt" }, { "date": "2018-11-22T23:00:00.000+00:00", "number": "4", "summary": "New remediations available" }, { "date": "2018-11-29T23:00:00.000+00:00", "number": "5", "summary": "New remediations available" }, { "date": "2018-12-02T23:00:00.000+00:00", "number": "6", "summary": "New remediations available" }, { "date": "201