Multiple vulnerabilities in Red Hat JBoss Core Services for RHEL 7 and 8

1) Heap-based buffer overflow

EUVDB-ID: #VU81865

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-38545

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the SOCKS5 proxy handshake. A remote attacker can trick the victim to visit a malicious website, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that SOCKS5 proxy is used and that SOCKS5 handshake is slow (e.g. under heavy load or DoS attack).

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Resource exhaustion

EUVDB-ID: #VU80732

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-38039

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not limit the size of received headers from a single request that are stored for future reference. A remote attacker can send overly large HTTP responses to the application and consume all memory resources.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) External control of file name or path

EUVDB-ID: #VU81863

Risk: Low

CVSSv3.1: 2.3 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-38546

CWE-ID: CWE-73 - External Control of File Name or Path

Exploit availability: No

Description

The vulnerability allows an attacker to inject arbitrary cookies into request.

The vulnerability exists due to the way cookies are handled by libcurl. If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Information disclosure

EUVDB-ID: #VU80760

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-41081

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests. A remote attacker can view status worker and possibly bypass security constraints configured in httpd.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource management error

EUVDB-ID: #VU78798

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-3817

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when checking the long DH keys. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU81728

Risk: High

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:C]

CVE-ID: CVE-2023-44487

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improperly control of consumption for internal resources when handling HTTP/2 requests with compressed HEADERS frames. A remote attacker can send a sequence of compressed HEADERS frames followed by RST_STREAM frames and perform a denial of service (DoS) attack, a.k.a. "Rapid Reset".

Note, the vulnerability is being actively exploited in the wild.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

7) Resource management error

EUVDB-ID: #VU82245

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-45802

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the server when handling HTTP/2 requests. A remote attacker can send multiple requests to the server and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource management error

EUVDB-ID: #VU78463

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-3446

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the DH_check(), DH_check_ex() and EVP_PKEY_param_check() function when processing a DH key or DH parameters. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU74148

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0465

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error when validating certificate policies in leaf certificates. A remote attacker that controls a malicious CA server can issue a certificate that will be validated by the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Resource management error

EUVDB-ID: #VU76651

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-2650

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when processing OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS subsystems with no message size limit. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Resource exhaustion

EUVDB-ID: #VU73960

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0464

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when verifying X.509 certificate chains that include policy constraints. A remote attacker can create a specially crafted certificate to trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Security features bypass

EUVDB-ID: #VU74149

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0466

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to an error within the X509_VERIFY_PARAM_add0_policy() function, which does not perform the certificate policy check despite being implicitly enabled. A remote attacker can bypass expected security restrictions and perform MitM attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

jbcs-httpd24-openssl-pkcs11 (Red Hat package): before 0.4.10-34.el8jbcs

jbcs-httpd24-openssl-chil (Red Hat package): before 1.0.0-19.el8jbcs

jbcs-httpd24-mod_security (Red Hat package): before 2.9.3-32.el8jbcs

jbcs-httpd24-mod_proxy_cluster (Red Hat package): before 1.3.19-7.el8jbcs

jbcs-httpd24-mod_md (Red Hat package): before 2.4.24-2.el8jbcs

jbcs-httpd24-mod_http2 (Red Hat package): before 1.15.19-32.el8jbcs

jbcs-httpd24-httpd (Red Hat package): before 2.4.57-7.el8jbcs

jbcs-httpd24-curl (Red Hat package): before 8.4.0-2.el8jbcs

jbcs-httpd24-apr-util (Red Hat package): before 1.6.1-103.el8jbcs

External links

http://access.redhat.com/errata/RHSA-2023:7625

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.