(RHSA-2014:0784) Moderate: Red Hat JBoss Web Server 2.0.1 httpd security and bug fix update

Red Hat JBoss Web Server is a fully integrated and certified set of
components for hosting Java web applications. It is comprised of the Apache
HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector
(mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat
Native library.

It was found that the mod_dav module did not correctly strip leading white
space from certain elements in a parsed XML. In certain httpd
configurations that use the mod_dav module (for example when using the
mod_dav_svn module), a remote attacker could send a specially crafted DAV
request that would cause the httpd child process to crash or, possibly,
allow the attacker to execute arbitrary code with the privileges of the
“apache” user. (CVE-2013-6438)

A buffer over-read flaw was found in the httpd mod_log_config module.
In configurations where cookie logging is enabled, a remote attacker could
use this flaw to crash the httpd child process via an HTTP request with a
malformed cookie header. (CVE-2014-0098)

This update also fixes the following bug:

It was discovered that the mod_log_config module, which provides logging of
client requests, truncated cookie values at the first occurrence of an
equal sign (‘=’) when using the “%{abc}C” syntax in a LogFormat definition.
(ASF Bug 53104)

All users of Red Hat JBoss Web Server 2.0.1 as provided from the Red Hat
Customer Portal are advised to apply this update. The Apache HTTP Server
must be restarted for this update to take effect.