This security advisory covers Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4, which addresses several vulnerabilities including CVE-2024-2004 (curl usage of disabled protocol), CVE-2024-2379 (curl QUIC certificate check bypass with wolfSSL), CVE-2024-2398 (curl HTTP/2 push headers memory leak), CVE-2024-2466 (curl TLS certificate check bypass with mbedTLS), CVE-2024-27316 (httpd CONTINUATION frames DoS), and CVE-2024-28182 (nghttp2 CONTINUATION frames DoS). These vulnerabilities affect components common to multiple JBoss middleware products and are fixed in this service pack update. The advisory provides links to detailed release notes and Red Hat errata for further information.

The vulnerabilities fixed in this update could allow attackers to bypass TLS certificate checks in curl with wolfSSL and mbedTLS, potentially undermining secure communications. Memory leaks in HTTP/2 push headers could lead to resource exhaustion. Denial of Service (DoS) vulnerabilities related to CONTINUATION frames in httpd and nghttp2 could allow attackers to disrupt service availability. Overall, these issues pose moderate security risks affecting confidentiality and availability of affected systems.

Red Hat has released Red Hat JBoss Core Services Apache HTTP Server 2.4.57 Service Pack 4 which addresses these vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their systems have been applied. Detailed update instructions are available in the Red Hat advisory and documentation. No additional mitigations are specified beyond applying the official update.