Multiple vulnerabilities in Red Hat JBoss Core Services

Published: 2022-04-21 | Updated: 2022-05-03

Risk	High
Patch available	YES
Number of vulnerabilities	8
CVE-ID	CVE-2022-22720 CVE-2021-3517 CVE-2021-3541 CVE-2021-3537 CVE-2021-3518 CVE-2022-0778 CVE-2022-23308 CVE-2021-3516
CWE-ID	CWE-444 CWE-787 CWE-20 CWE-476 CWE-416 CWE-835
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #6 is available.
Vulnerable software Subscribe	JBoss Core Services Server applications / Application servers jbcs-httpd24-openssl-pkcs11 (Red Hat package) Operating systems & Components / Operating system package or component jbcs-httpd24-openssl-chil (Red Hat package) Operating systems & Components / Operating system package or component jbcs-httpd24-nghttp2 (Red Hat package) Operating systems & Components / Operating system package or component jbcs-httpd24-mod_security (Red Hat package) Operating systems & Components / Operating system package or component jbcs-httpd24-mod_md (Red Hat package) Operating systems & Components / Operating system package or component jbcs-httpd24-mod_http2 (Red Hat package) Operating systems & Components / Operating system package or component jbcs-httpd24-httpd (Red Hat package) Operating systems & Components / Operating system package or component jbcs-httpd24-curl (Red Hat package) Operating systems & Components / Operating system package or component jbcs-httpd24-apr-util (Red Hat package) Operating systems & Components / Operating system package or component
Vendor	Red Hat Inc.

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU61286

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22720

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

JBoss Core Services: 2.4.37 SP8 - 2.4.37 SP10

jbcs-httpd24-openssl-pkcs11 (Red Hat package): 0.4.10-7.jbcs.el7 - 0.4.10-22.jbcs.el7

jbcs-httpd24-openssl-chil (Red Hat package): 1.0.0-3.jbcs.el7 - 1.0.0-7.jbcs.el7

jbcs-httpd24-nghttp2 (Red Hat package): 1.39.2-1.jbcs.el7 - 1.39.2-39.jbcs.el7

jbcs-httpd24-mod_security (Red Hat package): 2.9.2-16.GA.jbcs.el7 - 2.9.2-67.GA.jbcs.el7

jbcs-httpd24-mod_md (Red Hat package): 2.0.8-24.jbcs.el7 - 2.0.8-40.jbcs.el7

jbcs-httpd24-mod_http2 (Red Hat package): 1.15.7-3.jbcs.el7 - 1.15.7-21.jbcs.el7

jbcs-httpd24-httpd (Red Hat package): 2.4.37-33.jbcs.el7 - 2.4.37-78.jbcs.el7

jbcs-httpd24-curl (Red Hat package): 7.78.0-2.el8jbcs - 7.78.0-2.jbcs.el7

jbcs-httpd24-apr-util (Red Hat package): 1.6.1-9.jbcs.el7 - 1.6.1-84.jbcs.el7

CPE2.3

External links

http://access.redhat.com/errata/RHSA-2022:1389
http://access.redhat.com/errata/RHSA-2022:1390

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds write

EUVDB-ID: #VU54224

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3517

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the xml entity encoding functionality. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.