ID

VAR-201609-0597

CVE

CVE-2016-2183

TITLE

TLS  Used in products such as protocols  DES  and  Triple DES  Cryptographic plaintext data acquisition vulnerability

DESCRIPTION

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. This vulnerability is "Sweet32" It is called an attack.A third party could retrieve plaintext data through a birthday attack on a long encrypted session. IPSec (full name Internet Protocol Security) is a set of IP security protocols established by the IPSec group of the Internet Engineering Task Force (IETF). Both DES and Triple DES are encryption algorithms. This vulnerability stems from configuration errors in network systems or products during operation. An unauthorized attacker could exploit the vulnerability to obtain sensitive information of the affected components. Description: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. This release provides an update to httpd, OpenSSL and Tomcat 6/7 for Red Hat JBoss Web Server 2.1.2. The updates are documented in the Release Notes document linked to in the References. This release of Red Hat JBoss Web Server 2.1.2 Service Pack 2 serves as a update for Red Hat JBoss Web Server 2, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es): * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headers related to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-9788) * A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. (CVE-2017-12615) * A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution. (CVE-2017-12617) * A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. (CVE-2016-2183) * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash. (CVE-2017-9798) Red Hat would like to thank OpenVPN for reporting CVE-2016-2183 and Hanno BAPck for reporting CVE-2017-9798. Upstream acknowledges Karthikeyan Bhargavan (Inria) and GaA<<tan Leurent (Inria) as the original reporters of CVE-2016-2183. Bug Fix(es): * Corruption in nodestatsmem in multiple core dumps but in different functions of each core dump. (BZ#1338640) * mod_cluster segfaults in process_info() due to wrongly generated assembler instruction movslq (BZ#1448709) * CRL checking of very large CRLs fails with OpenSSL 1.0.2 (BZ#1493075) 4. Solution: Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). After installing the updated packages, the httpd daemon will be restarted automatically. Bugs fixed (https://bugzilla.redhat.com/): 1369383 - CVE-2016-2183 SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) 1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection in mod_auth_digest 1490344 - CVE-2017-9798 httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed) 1493075 - Unable to load large CRL openssl problem 1493220 - CVE-2017-12615 tomcat: Remote Code Execution via JSP Upload 1494283 - CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615 6. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201612-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: OpenSSL: Multiple vulnerabilities Date: December 07, 2016 Bugs: #581234, #585142, #585276, #591454, #592068, #592074, #592082, #594500, #595186 ID: 201612-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in OpenSSL, the worst of which allows attackers to conduct a time based side-channel attack. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/openssl < 1.0.2j >= 1.0.2j Description =========== Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers and the International Association for Cryptologic Research's (IACR) paper, "Make Sure DSA Signing Exponentiations Really are Constant-Time" for further details. Workaround ========== There is no known workaround at this time. Resolution ========== All OpenSSL users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.2j" References ========== [ 1 ] CVE-2016-2105 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2105 [ 2 ] CVE-2016-2106 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2106 [ 3 ] CVE-2016-2107 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2107 [ 4 ] CVE-2016-2108 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2108 [ 5 ] CVE-2016-2109 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2109 [ 6 ] CVE-2016-2176 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2176 [ 7 ] CVE-2016-2177 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2177 [ 8 ] CVE-2016-2178 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2178 [ 9 ] CVE-2016-2180 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2180 [ 10 ] CVE-2016-2183 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-2183 [ 11 ] CVE-2016-6304 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6304 [ 12 ] CVE-2016-6305 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6305 [ 13 ] CVE-2016-6306 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6306 [ 14 ] CVE-2016-7052 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7052 [ 15 ] Make Sure DSA Signing Exponentiations Really are Constant-Time http://eprint.iacr.org/2016/594.pdf Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201612-16 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . ========================================================================== Ubuntu Security Notice USN-3087-2 September 23, 2016 openssl regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: USN-3087-1 introduced a regression in OpenSSL. The fix for CVE-2016-2182 was incomplete and caused a regression when parsing certificates. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request extension. (CVE-2016-6304) Guido Vranken discovered that OpenSSL used undefined behaviour when performing pointer arithmetic. This issue has only been addressed in Ubuntu 16.04 LTS in this update. (CVE-2016-2177) CA(c)sar Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL did not properly use constant-time operations when performing DSA signing. A remote attacker could possibly use this issue to perform a cache-timing attack and recover private DSA keys. (CVE-2016-2178) Quan Luo discovered that OpenSSL did not properly restrict the lifetime of queue entries in the DTLS implementation. (CVE-2016-2179) Shi Lei discovered that OpenSSL incorrectly handled memory in the TS_OBJ_print_bio() function. (CVE-2016-2180) It was discovered that the OpenSSL incorrectly handled the DTLS anti-replay feature. (CVE-2016-2181) Shi Lei discovered that OpenSSL incorrectly validated division results. (CVE-2016-2182) Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. This update moves DES from the HIGH cipher list to MEDIUM. (CVE-2016-2183) Shi Lei discovered that OpenSSL incorrectly handled certain ticket lengths. A remote attacker could use this issue to cause a denial of service. (CVE-2016-6302) Shi Lei discovered that OpenSSL incorrectly handled memory in the MDC2_Update() function. (CVE-2016-6303) Shi Lei discovered that OpenSSL incorrectly performed certain message length checks. (CVE-2016-6306) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: libssl1.0.0 1.0.2g-1ubuntu4.5 Ubuntu 14.04 LTS: libssl1.0.0 1.0.1f-1ubuntu2.21 Ubuntu 12.04 LTS: libssl1.0.0 1.0.1-4ubuntu5.38 After a standard system update you need to reboot your computer to make all the necessary changes. Background ========== IcedTea's aim is to provide OpenJDK in a form suitable for easy configuration, compilation and distribution with the primary goal of allowing inclusion in GNU/Linux distributions. Please review the CVE identifiers referenced below for details. Note: If the web browser plug-in provided by the dev-java/icedtea-web package was installed, the issues exposed via Java applets could have been exploited without user interaction if a user visited a malicious website. http://creativecommons.org/licenses/by-sa/2.5 --eW2Ih3ajF3BNoJIAD1VrIt2me1kNx637S-- . Red Hat Quay is a secure, private container registry that builds, analyzes and distributes container images. It provides a high level of automation and customization. (CVE-2016-2183) Bug Fix(es): * Running Quay in config mode now works in a disconnected option which doesn't require pulling resources from the Internet. * Quay's security scan endpoint is now enabled at startup for viewing results of Clair container image scans. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. (BZ#1508885) 4. The JBoss server process must be restarted for the update to take effect. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: java-1.8.0-ibm security update Advisory ID: RHSA-2017:0462-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2017-0462.html Issue date: 2017-03-08 CVE Names: CVE-2016-2183 ===================================================================== 1. Summary: An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 6 Supplementary and Red Hat Enterprise Linux 7 Supplementary. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client Supplementary (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) - x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 7) - x86_64 3. Description: IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to version 8 SR4-FP1. Security Fix(es): * This update fixes a vulnerability in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about this flaw can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2016-2183) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of IBM Java must be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1369383 - CVE-2016-2183 SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: java-1.8.0-ibm-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-plugin-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.1.el6_8.i686.rpm x86_64: java-1.8.0-ibm-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm Red Hat Enterprise Linux HPC Node Supplementary (v. 6): x86_64: java-1.8.0-ibm-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: java-1.8.0-ibm-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-plugin-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.1.el6_8.i686.rpm ppc64: java-1.8.0-ibm-1.8.0.4.1-1jpp.1.el6_8.ppc64.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.1.el6_8.ppc64.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.1.el6_8.ppc64.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.1.el6_8.ppc64.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.1.el6_8.ppc64.rpm s390x: java-1.8.0-ibm-1.8.0.4.1-1jpp.1.el6_8.s390x.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.1.el6_8.s390x.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.1.el6_8.s390x.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.1.el6_8.s390x.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.1.el6_8.s390x.rpm x86_64: java-1.8.0-ibm-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: java-1.8.0-ibm-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-plugin-1.8.0.4.1-1jpp.1.el6_8.i686.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.1.el6_8.i686.rpm x86_64: java-1.8.0-ibm-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.1.el6_8.x86_64.rpm Red Hat Enterprise Linux Client Supplementary (v. 7): x86_64: java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.i686.rpm java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.i686.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.2.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Supplementary (v. 7): x86_64: java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.i686.rpm java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.i686.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.2.el7.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 7): ppc64: java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.ppc.rpm java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.ppc64.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.2.el7.ppc64.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.ppc.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.ppc64.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.2.el7.ppc64.rpm java-1.8.0-ibm-plugin-1.8.0.4.1-1jpp.2.el7.ppc64.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.2.el7.ppc64.rpm ppc64le: java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.ppc64le.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.2.el7.ppc64le.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.ppc64le.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.2.el7.ppc64le.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.2.el7.ppc64le.rpm s390x: java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.s390.rpm java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.s390x.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.2.el7.s390x.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.s390.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.s390x.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.2.el7.s390x.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.2.el7.s390x.rpm x86_64: java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.i686.rpm java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.i686.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.2.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 7): x86_64: java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.i686.rpm java-1.8.0-ibm-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.i686.rpm java-1.8.0-ibm-devel-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.4.1-1jpp.2.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.4.1-1jpp.2.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-2183 https://access.redhat.com/security/updates/classification/#moderate https://developer.ibm.com/javasdk/support/security-vulnerabilities/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYwAfWXlSAg2UNWIIRApdJAJ9aWdfCBOWjqVaBLGFXAtS6LJvZXACgkneE 4LO+U1cfPB3cdxvKJ71gfCg= =89qB -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Release Date: 2017-03-29 Last Updated: 2017-03-29 Potential Security Impact: Remote: Denial of Service (DoS), Unauthorized Read Access to Data Source: Hewlett Packard Enterprise, Product Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified with HP-UX Web Server Suite running Apache on HP-UX 11iv3. These vulnerabilities could be exploited remotely to create a Denial of Service (DoS), Unauthorized Read Access to Data and other impacts including: * Padding Oracle attack in Apache mod_session_crypto * Apache HTTP Request Parsing Whitespace Defects References: - CVE-2016-8740 - Apache http server, Denial of Service (DoS) - CVE-2016-2161 - Apache http server, Denial of Service (DoS) - CVE-2016-0736 - Apache http server, disclosure of information, padding oracle attack - CVE-2016-8743 - Apache http server, request corruption, request parsing white space - CVE-2016-2183 - OpenSSL, disclosure of information, SWEET32 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP-UX Apache-based Web Server B.11.31 - httpd prior to B.2.4.18.02 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2016-0736 0.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P) CVE-2016-2161 0.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P) CVE-2016-2183 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) CVE-2016-8740 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P) CVE-2016-8743 0.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499 RESOLUTION HPE has provided the following software updates to resolve the vulnerabilities with HP-UX Web Server Suite running Apache. Apache 2.4.18.02 for HP-UX Release B.11.31 (PA and IA): * 32 bit Depot: HP-UX 11.31(HPUXWS24ATW-B503-11-31-64.depot) * 64 bit Depot: HP-UX 11.31(HPUXWS24ATW-B503-11-31-32.depot) **Note:** The depot files can be found here: <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=HPUXWSATW503> MANUAL ACTIONS: Yes - Update Download and install the software update PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HPE and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: <https://h20392.www2.hpe.com/portal/swdepot/displayProductInfo.do?productNumb r=B6834AA> AFFECTED VERSIONS HP-UX B.11.31 IA/PA =================== hpuxws24APACHE.APACHE hpuxws24APACHE.APACHE2 hpuxws24APACHE.AUTH_LDAP hpuxws24APACHE.AUTH_LDAP2 hpuxws24APACHE.MOD_JK hpuxws24APACHE.MOD_JK2 hpuxws24APACHE.MOD_PERL hpuxws24APACHE.MOD_PERL2 hpuxws24APACHE.WEBPROXY hpuxws24APACHE.WEBPROXY2 action: install B.2.4.18.02 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 29 March 2017 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hpe.com. Report: To report a potential security vulnerability for any HPE supported product: Web form: https://www.hpe.com/info/report-security-vulnerability Email: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. This update causes NSS to limit use of the same symmetric key. After a standard system update you need to restart any applications that use NSS, such as Evolution and Chromium, to make all the necessary changes

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

arbitrary

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2026-08-28T22:27:10.889000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE