RHSA-2018:2185: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 security update

This release adds the new Apache HTTP Server 2.4.29 packages that are partof the JBoss Core Services offering.This release serves as a replacement for Red Hat JBoss Core ServicesApache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes,enhancements and component upgrades included in this release.This release upgrades OpenSSL to version 1.0.2.nSecurity Fix(es): openssl: Out-of-bounds write caused by unchecked errors in BNbn2dec() (CVE-2016-2182) openssl: Insufficient TLS session ticket HMAC length checks (CVE-2016-6302) openssl: certificate message OOB reads (CVE-2016-6306) openssl: Carry propagating bug in Montgomery multiplication (CVE-2016-7055) openssl: Truncated packet could crash via OOB read (CVE-2017-3731) openssl: BNmodexp may produce incorrect results on x8664 (CVE-2017-3732) openssl: bnsqrx8xinternal carry bug on x8664 (CVE-2017-3736) openssl: Read/write after SSL object in error state (CVE-2017-3737) openssl: rsaz1024mulavx2 overflow bug on x8664 (CVE-2017-3738) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6306 and CVE-2016-7055. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6306.