title: Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 2 security update
description: apr: Out-of-bounds array deref in apr_time_exp*() functions tomcat: Remote Code Execution via JSP Upload tomcat: Information Disclosure when using VirtualDirContext tomcat: Remote Code Execution bypass for CVE-2017-12615 tomcat-native: Mishandling of client certificates can allow for OCSP check bypass tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
cpes: cpe:/a:redhat:jboss_enterprise_web_server:3.1