httpd: allow connecting via SSL to a backend worker when the backend keystore file's ID is 'unknown'
Published Jan 7, 2021
5.4
MEDIUMCVSS 3.1
EPSS 0.33%
Description
A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and hostname are matching stopped working and allow connecting to the back-end work. The highest threat from this vulnerability is to data integrity.
Affected products
- Vendor n/a Product JBCS httpd Defaultn/a
- Version JBCS httpd 2.4.37 SP5StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | JBCS httpd | n/a |
|
- 2.4.37
No data.
JBoss Core Services on RHEL 6
jbcs-httpd24-apr-0:1.6.3-104.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-brotli-0:1.0.6-38.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-curl-0:7.64.1-44.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-httpd-0:2.4.37-64.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-jansson-0:2.11-53.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-mod_cluster-native-0:1.3.14-11.Final_redhat_2.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-mod_http2-0:1.15.7-11.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-mod_jk-0:1.2.48-10.redhat_1.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-mod_md-1:2.0.8-30.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-mod_security-0:2.9.2-57.GA.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-nghttp2-0:1.39.2-34.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6
jbcs-httpd24-openssl-1:1.1.1c-32.jbcs.el6
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-apr-0:1.6.3-104.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-brotli-0:1.0.6-38.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-curl-0:7.64.1-44.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-httpd-0:2.4.37-64.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-jansson-0:2.11-53.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-mod_cluster-native-0:1.3.14-11.Final_redhat_2.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-mod_http2-0:1.15.7-11.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-mod_jk-0:1.2.48-10.redhat_1.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-mod_md-1:2.0.8-30.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-mod_security-0:2.9.2-57.GA.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-nghttp2-0:1.39.2-34.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-openssl-1:1.1.1c-32.jbcs.el7
Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7
jbcs-httpd24-openssl-chil-0:1.0.0-1.jbcs.el7
Fixed · RHSA-2020:4384
| Product | Package | State | Advisory |
|---|---|---|---|
| JBoss Core Services on RHEL 6 | jbcs-httpd24-apr-0:1.6.3-104.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-brotli-0:1.0.6-38.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-curl-0:7.64.1-44.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-httpd-0:2.4.37-64.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-jansson-0:2.11-53.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-mod_cluster-native-0:1.3.14-11.Final_redhat_2.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-mod_http2-0:1.15.7-11.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-mod_jk-0:1.2.48-10.redhat_1.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-mod_md-1:2.0.8-30.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-mod_security-0:2.9.2-57.GA.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-nghttp2-0:1.39.2-34.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 6 | jbcs-httpd24-openssl-1:1.1.1c-32.jbcs.el6 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-apr-0:1.6.3-104.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-brotli-0:1.0.6-38.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-curl-0:7.64.1-44.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-httpd-0:2.4.37-64.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-jansson-0:2.11-53.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-mod_cluster-native-0:1.3.14-11.Final_redhat_2.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-mod_http2-0:1.15.7-11.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-mod_jk-0:1.2.48-10.redhat_1.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-mod_md-1:2.0.8-30.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-mod_security-0:2.9.2-57.GA.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-nghttp2-0:1.39.2-34.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-openssl-1:1.1.1c-32.jbcs.el7 | Fixed | RHSA-2020:4384 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-openssl-chil-0:1.0.0-1.jbcs.el7 | Fixed | RHSA-2020:4384 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (5)
- https://access.redhat.com/security/cve/CVE-2020-25680 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1892703 x_refsource_MISCIssue TrackingThird Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-18342 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-25680
- https://www.cve.org/CVERecord?id=CVE-2020-25680
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-25680 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1892703 | x_refsource_MISCIssue TrackingThird Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-18342 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-25680 | ||
| https://www.cve.org/CVERecord?id=CVE-2020-25680 |
Change history (0)
No recorded changes yet.