[RHSA-2015:1621-01] Moderate: Red Hat JBoss Web Server 2.1.0 tomcat security update

[bugzilla at redhat.com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat JBoss Web Server 2.1.0 tomcat security update
Advisory ID:       RHSA-2015:1621-01
Product:           Red Hat JBoss Web Server
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2015-1621.html
Issue date:        2015-08-13
CVE Names:         CVE-2014-0230 CVE-2014-7810 
=====================================================================

1. Summary:

An update for the Apache Tomcat 6 and Apache Tomcat 7 component for Red Hat
JBoss Web Server 2.1.0 that fixes two security issues is now available from
the Red Hat Customer Portal.

Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Description:

Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.

It was found that the expression language resolver evaluated expressions
within a privileged code section. A malicious web application could use
this flaw to bypass security manager protections. (CVE-2014-7810)

It was found that Tomcat would keep connections open after processing
requests with a large enough request body. A remote attacker could
potentially use this flaw to exhaust the pool of available connections and
preventing further, legitimate connections to the Tomcat server to be made.
(CVE-2014-0230)

All users of Red Hat JBoss Web Server 2.1.0 as provided from the Red Hat
Customer Portal are advised to apply this update. The Red Hat JBoss Web
Server process must be restarted for the update to take effect.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Web Server installation (including all applications
and configuration files).

4. Bugs fixed (https://bugzilla.redhat.com/):

1191200 - CVE-2014-0230 tomcat: non-persistent DoS attack by feeding data by aborting an upload
1222573 - CVE-2014-7810 Tomcat/JbossWeb: security manager bypass via EL expressions

5. References:

https://access.redhat.com/security/cve/CVE-2014-0230
https://access.redhat.com/security/cve/CVE-2014-7810
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=webserver&downloadType=securityPatches&version=2.1.0

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2015 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFVzLo0XlSAg2UNWIIRAn5EAJ0VDF059K780gyI6N/2jVjcSbclfgCglMLb
yFR0tJnxS1RBQ+xgM8XpQQg=
=Bgvs
-----END PGP SIGNATURE-----