Red Hat SummitRed Hat JBoss Web Server 3.1 Service Pack 8 Release Notes
For Use with the Red Hat JBoss Web Server 3.1
Abstract
Chapter 1. Red Hat JBoss Web Server Version 3.1 Service Pack 8
Welcome to the Red Hat JBoss Web Server version 3.1 Service Pack 8 release.
The primary focus of this release is to provide security updates to Red Hat JBoss Web Server version 3.1.
As a result of a security vulnerability (CVE-2020-1938), it is recommended that one disable the AJP Connector, if unusued. Otherwise it is recommended to protect the AJP Connector. For full information and steps, see:https://access.redhat.com/solutions/4851251
When using AJP, it is important to ensure it is not exposed to the internet and that it is bound to the proper IP address.
The JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It consists of:
- Apache Tomcat: a servlet container in accordance with the Java Servlet Specification. JBoss Web Server contains Apache Tomcat 7 and Apache Tomcat 8.
- The Apache Tomcat Native Library: a Tomcat library, which improves Tomcat scalability, performance, and integration with native server technologies.
- The tomcat-vault extension: an extension for the JBoss Web Server used for securely storing passwords and other sensitive information used by a JBoss Web Server.
- The mod_cluster library: a library that allows communication between Apache Tomcat and the Apache HTTP Server’s mod_proxy_cluster module. This allows the Apache HTTP Server to be used as a load balancer for JBoss Web Server.
Service packs for Red Hat JBoss Web Server are produced when a set of critical bug fixes and/or security patches are required before a new full release.
These service pack releases reduce the number of individual patches that we produce and enable customers to keep up to date.
This update includes all fixes and changes from Red Hat JBoss Web Server 3.1 Service Pack 7.
From Red Hat JBoss Web Server 3.1 Service Pack 2, all the configuration files that were changed in the patch are appended by the suffix .zipnew to avoid overwriting existing configuration files.
If the new or changed properties or configuration options are applicable to you, you will need to manually add or define them in their respective property or configuration file.
Chapter 2. Installing the Red Hat JBoss Web Server 3.1
The JBoss Web Server 3.1 can be installed using one of the following sections of the installation guide:
Chapter 3. Upgrading Red Hat JBoss Web Server using this Service Pack
To install this service pack:
-
Download the Red Hat JBoss Web Server 3.1 Service Pack 8 file (
.zipformat) appropriate to your platform using the download link here (subscription required). -
Extract the
.zipfile to the Red Hat JBoss Web Server installation directory.
For Red Hat Enterprise Linux users who have installed Red Hat JBoss Web Server from RPM packages, can upgrade to the latest service pack using yum:
yum upgrade
# yum upgradeChapter 4. OS/JVM Certifications
This update includes no additional certifications.
Chapter 5. Security Fixes
This update includes fixes for the following security related issues:
| ID | Impact | Summary |
|---|---|---|
| Moderate | ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries | |
| Moderate | openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang | |
| Low | openssl: timing side channel attack in the DSA signature algorithm | |
| Low | openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys | |
| Low | tomcat: XSS in SSI printenv | |
| Moderate | openssl: 0-byte record padding oracle | |
| Moderate | tomcat: local privilege escalation | |
| Low | tomcat: session fixation when using FORM authentication | |
| Important | Ghostcat - Apache Tomcat AJP File Read/Inclusion Vulnerability (CNVD-2020-10487) |
Chapter 6. Resolved issues
The following issues are resolved in the current service pack:
| Issue | Description |
|---|---|
| JWS-1527 | Use latest JBCS and tomcat-native |
| JWS-1578 | Add rpm changelog entry for CVE-2018-1336 |
Chapter 7. Known issues
The following issues are known in the current service pack release:
| Issue | Description |
|---|---|
| JWS-1583 | Update all of the StringManager references back to the original class reference and add the call to getPackage().getName() so that the inits are able to find LocalStrings.properties in the correct packages |
| Bugzilla Bug-1455483 | RFE: Add support for characters "<" and ">" to the possible whitelist values |
Chapter 8. Upgraded components
The following components were upgraded in the Red Hat JBoss Web Server 3.1 Service Pack 8 Release:
| Component | Version |
|---|---|
| OpenSSL | 1.1.1c |
| Tomcat-native | 1.2.23 |
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}