[Bug 1222923] New: CVE-2015-2156 netty: HttpOnly cookie bypass
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1222923
Bug ID: 1222923
Summary: CVE-2015-2156 netty: HttpOnly cookie bypass
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
asantos(a)redhat.com, aszczucz(a)redhat.com,
bdawidow(a)redhat.com, bkearney(a)redhat.com,
brms-jira(a)redhat.com, cbillett(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cpelland(a)redhat.com, cperry(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
epp-bugs(a)redhat.com, etirelli(a)redhat.com,
felias(a)redhat.com, fnasser(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
hfnukal(a)redhat.com, huwang(a)redhat.com,
jason.greene(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jbpapp-maint(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jerboaa(a)gmail.com,
jolee(a)redhat.com, jon.vanalten(a)redhat.com,
jpallich(a)redhat.com, katello-bugs(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lpetrovi(a)redhat.com, mbaluch(a)redhat.com,
mmccune(a)redhat.com, mnovotny(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com,
mweiler(a)redhat.com, mwinkler(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
ohadlevy(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pslavice(a)redhat.com,
rhq-maint(a)redhat.com, rrajasek(a)redhat.com,
rsvoboda(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com,
tomckay(a)redhat.com, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
A flaw was found in the way Netty’s CookieDecoder method validated cookie name
and value characters. An attacker could use this flaw to bypass the httpOnly
flag on sensitive cookies.
Upstream patch:
https://github.com/slandelle/netty/commit/800555417e77029dcf8a31d7de44f27...
External References:
https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOn...
http://engineering.linkedin.com/security/look-netty%E2%80%99s-recent-secu...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Vfly1r8bG5&a=cc_unsubscribe
8 years, 3 months
[Bug 1252823] New: Please include plugin script
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1252823
Bug ID: 1252823
Summary: Please include plugin script
Product: Fedora
Version: 22
Component: elasticsearch
Assignee: jvanek(a)redhat.com
Reporter: pahan(a)hubbitus.info
QA Contact: extras-qa(a)fedoraproject.org
CC: bobjensen(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jvanek(a)redhat.com, pbrobinson(a)gmail.com,
zbyszek(a)in.waw.pl
Hello.
In repack.sh you delete "elasticsearch elasticsearch.bat
elasticsearch-service-mgr.exe elasticsearch-service-x64.exe
elasticsearch-service-x86.exe plugin plugin.bat service.bat".
I understand what binaries must be stripped. But what with plugin, which is
just shell script? I assume it is not sane way install such plugions which is
not in rpm form, and it is main reason of excludin, is not? But may we let it
on administrator choose when desired plugin is not packaged?
Could you please include that script in package as it done in upstream rpm?
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=mqaMrd907k&a=cc_unsubscribe
8 years, 3 months
[Bug 1195244] New: Mis-configured logging mutes log messages
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1195244
Bug ID: 1195244
Summary: Mis-configured logging mutes log messages
Product: Fedora
Version: 22
Component: javapackages-tools
Assignee: mizdebsk(a)redhat.com
Reporter: leamas.alec(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
Created attachment 994371
--> https://bugzilla.redhat.com/attachment.cgi?id=994371&action=edit
Test case provoking bug with non-readable metadata.
Description of problem:
Version-Release number of selected component (if applicable):
How reproducible: Always
Steps to Reproduce:
1. Install DecodeIrCaller from
https://copr.fedoraproject.org/coprs/leamas/harctoolbox/
2. For the example, create a bug:
$ sudo chmod 600 /usr/share/maven-metadata/DecodeIrCaller.xml
3.Run attached maven.req. It is a patched version of the thing
run by rpmbuild
$ ./maven.req
4. Watch in output
Processing files: IrpMaster-1.0.2-1.fc21.noarch
No handlers could be found for logger "pyxb.binding.basis"
No handlers could be found for logger "pyxb.binding.basis"
The messages stems from the XML parsing in
javapackages/metadata/pyxbmetadata.py around line 59. Obviously, they are not
really helpful, loggers should be configure
Actual results:
Useless messages
Expected results:
Good messages.
Additional info:
Same thing is likely to happen for any maven-driver spec given a non-readable
metadata dependency. And there are other things which might got wrong, needing
configured logger I guess.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AcTChb0Kzb&a=cc_unsubscribe
8 years, 4 months
[Bug 1258515] New: jenkins: CSFR vulnerability allowing remote attacker to hijack authentication
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1258515
Bug ID: 1258515
Summary: jenkins: CSFR vulnerability allowing remote attacker
to hijack authentication
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, logans(a)cottsay.net,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com
CSFR vulnerability in Jenkins 1.626 was found, allowing remote attackers to
hijack the authentication of users for most requests. It can be exploited to
change change specific settings or execute code.
Report (includes reproducers):
http://seclists.org/bugtraq/2015/Aug/161
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=fjM9Fr9yWG&a=cc_unsubscribe
_______________________________________________
java-sig-commits mailing list
java-sig-commits(a)lists.fedoraproject.org
http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedorapro...
8 years, 4 months
[Bug 1266550] New: gradle should define minimal required version of dom4j dependency
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1266550
Bug ID: 1266550
Summary: gradle should define minimal required version of dom4j
dependency
Product: Fedora
Version: rawhide
Component: gradle
Assignee: mizdebsk(a)redhat.com
Reporter: pahan(a)hubbitus.info
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mgoldman(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, mspaulding06(a)gmail.com,
msrb(a)redhat.com
Description of problem:
I'm on Fedora 22, upgrade gradle from rawhide:
$ dnf upgrade gradle --enablerepo=rawhide
It installs, but does not work:
$ gradle --version
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
-Dsun.java2d.pmoffscreen=false -XX:+UseCompressedOops -XX:+DoEscapeAnalysis
-XX:+AggressiveOpts -XX:+EliminateLocks -XX:+UseParallelGC -XX:+UseNUMA
-XX:+TieredCompilation
java.lang.IllegalArgumentException: Cannot find JAR 'dom4j.jar' required by
module 'gradle-ui' using classpath or distribution directory
'/usr/share/gradle'
at
org.gradle.api.internal.classpath.DefaultModuleRegistry.findDependencyJar(DefaultModuleRegistry.java:224)
at
org.gradle.api.internal.classpath.DefaultModuleRegistry.module(DefaultModuleRegistry.java:118)
at
org.gradle.api.internal.classpath.DefaultModuleRegistry.loadModule(DefaultModuleRegistry.java:92)
at
org.gradle.api.internal.classpath.DefaultModuleRegistry.getModule(DefaultModuleRegistry.java:80)
at
org.gradle.api.internal.classpath.DefaultModuleRegistry.module(DefaultModuleRegistry.java:124)
at
org.gradle.api.internal.classpath.DefaultModuleRegistry.loadModule(DefaultModuleRegistry.java:92)
at
org.gradle.api.internal.classpath.DefaultModuleRegistry.getModule(DefaultModuleRegistry.java:80)
at
org.gradle.api.internal.DefaultClassPathProvider.findClassPath(DefaultClassPathProvider.java:33)
at
org.gradle.api.internal.DefaultClassPathRegistry.getClassPath(DefaultClassPathRegistry.java:34)
at
org.gradle.launcher.bootstrap.ProcessBootstrap.runNoExit(ProcessBootstrap.java:47)
at
org.gradle.launcher.bootstrap.ProcessBootstrap.run(ProcessBootstrap.java:35)
at org.gradle.launcher.GradleMain.main(GradleMain.java:23)
Version-Release number of selected component (if applicable):
$ rpm -q dom4j gradle
dom4j-1.6.1-25.fc23.noarch
gradle-2.7-1.fc24.noarch
$ dnf history info 205
Last metadata expiration check performed 0:11:42 ago on Fri Sep 25 17:51:39
2015.
Transaction ID : 205
Begin time : Fri Sep 25 17:59:36 2015
Begin rpmdb : 2976:6a1ae69a37e35730ff5c45780210d14dbbf0f9f3
End time : 17:59:39 2015 (3 seconds)
End rpmdb : 2976:fa64b1f342dbfb8174ecf8c8f0236d1eb7c1241e
User : <pasha>
Return-Code : Success
Command Line : upgrade dom4j --enablerepo=rawhide
Transaction performed with:
Installed dnf-1.1.1-2.fc22.noarch @updates
Installed rpm-4.12.0.1-12.fc22.x86_64 @updates
Packages Altered:
Upgraded dom4j-1.6.1-22.fc21.noarch @fedora
Upgrade 1.6.1-25.fc23.noarch @rawhide
$ dnf upgrade dom4j --enablerepo=rawhide
Solve problem.
How reproducible:
Always
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=2Frd1ypRZJ&a=cc_unsubscribe
8 years, 4 months