[Bug 1102152] New: CVE-2014-0096 Apache Tomcat: XXE vulnerability via user supplied XSLTs [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1102152
Bug ID: 1102152
Summary: CVE-2014-0096 Apache Tomcat: XXE vulnerability via
user supplied XSLTs [fedora-all]
Product: Fedora
Version: 20
Component: tomcat
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: ivan.afonichev(a)gmail.com
Reporter: aneelica(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Blocks: 1088342 (CVE-2014-0096)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1088342
[Bug 1088342] CVE-2014-0096 Apache Tomcat: XXE vulnerability via user
supplied XSLTs
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=DrFKA9rqrC&a=cc_unsubscribe
9 years, 3 months
[Bug 1017702] New: javapackages-tools: Incorrect requires on package providing filesystem
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1017702
Bug ID: 1017702
Summary: javapackages-tools: Incorrect requires on package
providing filesystem
Product: Fedora
Version: rawhide
Component: javapackages-tools
Assignee: sochotni(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
sochotni(a)redhat.com
Description of problem:
Packages with non-empty <namespace> have auto-requires on jpackage-utils
instead on <namespace>-runtime.
Version-Release number of selected component (if applicable):
3.3.1-1
Steps to Reproduce:
Run autorequires generator for package with the following fragment:
$ cat depmap.xml
<?xml version="1.0" encoding="US-ASCII"?>
<!-- This depmap file was generated by XMvn -->
<dependencyMap>
<dependency>
<maven>
<namespace>maven31</namespace>
<groupId>org.eclipse.aether</groupId>
<artifactId>aether-api</artifactId>
<version>0.9.0.M3</version>
</maven>
<jpp>
<namespace>maven31</namespace>
<groupId>JPP/maven31-aether</groupId>
<artifactId>aether-api</artifactId>
</jpp>
</dependency>
</dependencyMap>
Actual results:
Generated Requires is:
jpackage-utils
Expected results:
Generated Requires should be:
maven31-runtime
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=GVVUPaGAHS&a=cc_unsubscribe
9 years, 4 months
[Bug 1147899] New: jenkins: maven-project plugin doesn't work
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1147899
Bug ID: 1147899
Summary: jenkins: maven-project plugin doesn't work
Product: Fedora
Version: 21
Component: jenkins
Assignee: msrb(a)redhat.com
Reporter: msrb(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
msrb(a)redhat.com
Description of problem:
This is probably related to core plugins (rhbz#1147838), but it needs some
investigating. When I am trying to build maven project with maven-plugin, I am
always getting:
Started by user anonymous
Building in workspace /var/lib/jenkins/jobs/maven1/workspace
Cloning the remote Git repository
Cloning repository https://github.com/kohsuke/akuma.git
> git init /var/lib/jenkins/jobs/maven1/workspace # timeout=10
Fetching upstream changes from https://github.com/kohsuke/akuma.git
> git --version # timeout=10
> git fetch --tags --progress https://github.com/kohsuke/akuma.git
+refs/heads/*:refs/remotes/origin/*
> git config remote.origin.url https://github.com/kohsuke/akuma.git #
timeout=10
> git config remote.origin.fetch +refs/heads/*:refs/remotes/origin/* #
timeout=10
> git config remote.origin.url https://github.com/kohsuke/akuma.git #
timeout=10
Fetching upstream changes from https://github.com/kohsuke/akuma.git
> git fetch --tags --progress https://github.com/kohsuke/akuma.git
+refs/heads/*:refs/remotes/origin/*
> git rev-parse refs/remotes/origin/master^{commit} # timeout=10
> git rev-parse refs/remotes/origin/origin/master^{commit} # timeout=10
Checking out Revision 0440b32a2040894cd22c48e2e4603a3c3d64948d
(refs/remotes/origin/master)
> git config core.sparsecheckout # timeout=10
> git checkout -f 0440b32a2040894cd22c48e2e4603a3c3d64948d
First time build. Skipping changelog.
Parsing POMs
FATAL: null
java.lang.StackOverflowError
at sun.reflect.GeneratedMethodAccessor147.invoke(Unknown Source)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:483)
at
com.google.inject.internal.DelegatingInvocationHandler.invoke(DelegatingInvocationHandler.java:40)
...
Version-Release number of selected component (if applicable):
1.581-2
How reproducible:
always
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=12aZMdAMUN&a=cc_unsubscribe
9 years, 4 months
[Bug 1103804] New: CVE-2014-0095 Apache Tomcat 8: Denial of service via AJP requests with content length zero
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1103804
Bug ID: 1103804
Summary: CVE-2014-0095 Apache Tomcat 8: Denial of service via
AJP requests with content length zero
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: aneelica(a)redhat.com
CC: aneelica(a)redhat.com, dknox(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jdoyle(a)redhat.com, jkurik(a)redhat.com,
krzysztof.daniel(a)gmail.com, lgao(a)redhat.com,
pslavice(a)redhat.com, rsvoboda(a)redhat.com,
weli(a)redhat.com
A regression was introduced in revision 1519838 (released with Apache Tomcat
8.0.0-RC2) that caused AJP requests to hang if an explicit content length of
zero was set on the request. The hanging request consumed a request processing
thread which could lead to a denial of service.
Affects:
Apache Tomcat 8.0.0-RC2 to 8.0.3
References:
http://tomcat.apache.org/security-8.html
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=VzK3kzgUi6&a=cc_unsubscribe
9 years, 4 months