Loading story…
Red Hat released JBoss Enterprise Web Server 2.1.1 for RHEL 6 and RHEL 7 to address four Important vulnerabilities in Apache HTTP Server, OpenSSL, and mod_cluster. The update fixes CVE-2016-5387 (HTTPoxy), where an attacker-supplied Proxy HTTP header can set the HTTP_PROXY environment variable for CGI scripts and redirect their outbound HTTP requests through an attacker-controlled proxy.
The advisories also remediate OpenSSL integer-overflow buffer-overflow flaws CVE-2016-2105 and CVE-2016-2106, which could cause denial of service or potentially code execution, and CVE-2016-3110, a crafted mod_cluster MCMP-message flaw that can crash Apache httpd. Red Hat advised affected organizations to back up installations, apply the update, restart JBoss and OpenSSL-linked services, or reboot affected hosts.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2016:1851 to fix CVE-2016-5387 in the jbcs-httpd24-httpd package for JBoss Core Services on RHEL 6 and RHEL 7.
Red Hat issued RHSA-2016:1648, upgrading JBoss Web Server 2.1.0 to 2.1.1 on RHEL 7. The advisory remediated HTTPoxy and the OpenSSL and mod_cluster vulnerabilities CVE-2016-2105, CVE-2016-2106, and CVE-2016-3110.
Red Hat issued RHSA-2016:1649, upgrading JBoss Web Server 2.1.0 to 2.1.1 on RHEL 6. The update fixed HTTPoxy along with CVE-2016-2105, CVE-2016-2106, and CVE-2016-3110.
The Apache Software Foundation published an HTTPoxy advisory recommending that Apache HTTP Server deployments strip inbound Proxy headers or apply a source patch for CVE-2016-5387. It also documented mitigations and a planned patch for Apache Tomcat's optional CGI Servlet, tracked as CVE-2016-5388.
Red Hat issued RHSA-2016:1421 for RHEL 5 and RHEL 6 and RHSA-2016:1422 for RHEL 7, updating the httpd package to remediate CVE-2016-5387 (HTTPoxy).
Red Hat resolved Bugzilla 1338646 as ERRATA through RHSA-2016:1650, updating JBoss Enterprise Web Server 2 from version 2.1.0 to 2.1.1 to address CVE-2016-3110. The medium-severity mod_cluster flaw could be exploited remotely to cause the Apache HTTP Server to segfault.
Red Hat closed Bugzilla 1337155 as ERRATA and directed JBoss Enterprise Web Server 2.1.0 users to RHSA-2016:1650 for updated packages addressing the medium-severity OpenSSL EVP_EncryptUpdate overflow, CVE-2016-2106, in JBEWS 2.1.1.
Red Hat closed Bugzilla issue 1358118 as ERRATA after RHSA-2016:1650 supplied updated files fixing CVE-2016-5387 in JBoss Enterprise Web Server 2.1.1. The issue also noted that an affected-looking libhttpd.dll in EAP 5.2 was a packaging error and should not be used.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourcerhn.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcerhn.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released JBoss Web Server 2.1.0 for Red Hat Enterprise Linux 5 and 6, replacing version 2.0.1 and addressing five Apache HTTP Server and Apache Tomcat vulnerabilities. The update fixes a `mod_status` heap-buffer-overflow issue that could enable remote code execution, denial-of-service flaws in `mod_deflate` and `mod_cgid`, and XML-processing weaknesses including XXE information disclosure. The release also remediates **CVE-2014-0119**, in which a malicious application could, in limited circumstances, hijack XML parsers used by Tomcat/JBoss Web. This could bypass XXE restrictions and expose XML files handled by other applications on the same server instance. Red Hat advised affected users to apply prerequisite errata, back up applications and configurations, upgrade to JBoss Web Server 2.1.0, and restart the JBoss server process.
Aug 29, 2026
Red Hat released security updates for affected JBoss Enterprise Application Platform 6.4 and JBoss Core Services Apache HTTP Server 2.4.23 deployments, addressing multiple OpenSSL and Apache HTTP Server vulnerabilities. The OpenSSL fixes include **CVE-2016-8610** (“SSL-Death-Alert”), **CVE-2016-6304**, **CVE-2016-2178**, and **CVE-2016-2177**, which can enable remote memory or CPU exhaustion, crashes caused by integer-overflow conditions, and potential local recovery of DSA private-key material. The Apache HTTP Server service-pack update also resolves vulnerabilities associated with denial of service, padding-oracle attacks, request smuggling and cache poisoning, and local private-key recovery. Affected organizations should apply the relevant Red Hat updates, then restart JBoss server processes and other services linked to OpenSSL, or reboot systems to ensure patched libraries are loaded.
Aug 31, 2026
Red Hat issued Important updates for JBoss Enterprise Application Platform, Enterprise Web Platform, BPM Suite, and BRMS to remediate SSL/TLS hostname-verification flaws in Apache HttpComponents, Apache CXF, and Jakarta Commons HttpClient. The vulnerabilities, **CVE-2012-6153** and **CVE-2014-3577**, could let a man-in-the-middle attacker use a specially crafted X.509 certificate to impersonate a trusted SSL server. The defects stemmed from incomplete prior hostname-verification remediation and incorrect extraction of hostnames from certificate subject Common Name fields. Affected deployments include JBoss EAP 5.2 and 6.3, Enterprise Web Platform 5.2, and roll-up patch releases for JBoss BPM Suite and BRMS 6.0.3 across supported Red Hat Enterprise Linux versions. Administrators should apply the applicable Red Hat errata or roll-up patches, back up installations and preserve customized configurations where required, then restart the JBoss server process; BPM Suite and BRMS installations should be stopped before patching.
Aug 29, 2026