[Bug 1222576] New: CVE-2014-7810 tomcat: Tomcat/JbossWeb: security manager bypass via EL expressions [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1222576
Bug ID: 1222576
Summary: CVE-2014-7810 tomcat: Tomcat/JbossWeb: security
manager bypass via EL expressions [fedora-all]
Product: Fedora
Version: 21
Component: tomcat
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: ivan.afonichev(a)gmail.com
Reporter: mprpic(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
Blocks: 1222573 (CVE-2014-7810)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1222573
[Bug 1222573] CVE-2014-7810 Tomcat/JbossWeb: security manager bypass via EL
expressions
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=bqqGMkX9c1&a=cc_unsubscribe
8 years, 5 months
[Bug 1147963] New: JENKINS script for showing failed jobs is not working
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1147963
Bug ID: 1147963
Summary: JENKINS script for showing failed jobs is not working
Product: Fedora
Version: 21
Component: jenkins
Severity: medium
Assignee: msrb(a)redhat.com
Reporter: amsharma(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
msrb(a)redhat.com
Description of problem:
JENKINS script for showing failed jobs is not working
Version-Release number of selected component (if applicable):
[root@dhcp201-185 ~]# rpm -qa | grep jenkins
jenkins-icon-shim-1.0.3-1.fc21.noarch
js-yui2-jenkins-2.9.0-6.fc21.noarch
jenkins-task-reactor-1.4-2.fc21.noarch
jenkins-external-monitor-job-plugin-1.2-1.fc21.noarch
jenkins-javadoc-plugin-1.2-1.fc21.noarch
jenkins-commons-jelly-1.1.20120928-6.fc21.noarch
jenkins-instance-identity-1.3-4.fc21.noarch
jenkins-sshd-1.6-4.fc21.noarch
jenkins-1.581-2.fc21.noarch
jenkins-ant-plugin-1.2-1.fc21.noarch
jenkins-executable-war-1.29-3.fc21.noarch
jenkins-xstream-1.4.7-3.jenkins1.fc21.noarch
trilead-ssh2-217-4.jenkins4.fc21.noarch
jenkins-ssh-cli-auth-1.2-4.fc21.noarch
jenkins-core-1.581-2.fc21.noarch
jenkins-remoting-2.43-1.fc21.noarch
jenkins-json-lib-2.4-7.fc21.noarch
jenkins-junit-plugin-1.1-1.fc21.noarch
jenkins-mailer-plugin-1.11-1.fc21.noarch
jenkins-extras-memory-monitor-1.8-1.fc21.noarch
jenkins-crypto-util-1.4-2.fc21.noarch
jenkins-version-number-1.1-4.fc21.noarch
jenkins-webapp-1.581-2.fc21.noarch
jenkins-winstone-2.3-1.fc21.noarch
jenkins-jexl-1.1-3.20111212.fc21.noarch
jenkins-cli-1.581-2.fc21.noarch
How reproducible:
Always
Steps to Reproduce:
1.go to https://wiki.jenkins-ci.org/display/JENKINS/Failed+Jobs
2. copy script and paste in localhost:8080/script
Actual results:
It does not display anything in output.
Result
Result: []
Expected results:
It should display all failed jobs
Additional info:
I had failed jobs in my jenkins
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=63mWa2HTjL&a=cc_unsubscribe
8 years, 5 months
[Bug 1147105] New: CATALINA_OPTS are only read when SECURITY_MANAGER is true
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1147105
Bug ID: 1147105
Summary: CATALINA_OPTS are only read when SECURITY_MANAGER is
true
Product: Fedora
Version: 20
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: awood(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Description of problem:
The CATALINA_OPTS configuration value is ignored during Tomcat start-up unless
the SECURITY_MANAGER configuration value is set to true. By default
SECURITY_MANAGER is set to "false" so this issue can be pretty confusing if
you're trying to add to CATALINA_OPTS and nothing happens.
Version-Release number of selected component (if applicable):
tomcat-7.0.52-1.fc20.noarch
How reproducible: Always
Steps to Reproduce:
1. Edit /etc/tomcat/tomcat.conf
2. Set CATALINA_OPTS to something.
"-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=8000" for
example.
3. Set SECURITY_MANAGER to "false"
3. Restart tomcat.
4. pgrep -fla tomcat
Actual results: The pgrep command reveals that Tomcat is running without the
values set in CATALINA_OPTS.
Expected results: CATALINA_OPTS are present.
Additional info: This bug is actually due to the fix to bug 1051194. In the
bugfix, the reading in of CATALINA_OPTS has been moved in
/usr/libexec/tomcat/server into a block that requires SECURITY_MANAGER to be
true.
if [ "$1" = "start" ] ; then
if [ "${SECURITY_MANAGER}" = "true" ] ; then
FLAGS="${FLAGS} $CATALINA_OPTS"
OPTIONS="${OPTIONS} \
-Djava.security.manager \
-Djava.security.policy==${CATALINA_BASE}/conf/catalina.policy"
fi
run start
I propose that the flags be read before looking at the security manager
settings. Like
if [ "$1" = "start" ] ; then
FLAGS="${FLAGS} $CATALINA_OPTS"
if [ "${SECURITY_MANAGER}" = "true" ] ; then
OPTIONS="${OPTIONS} \
-Djava.security.manager \
-Djava.security.policy==${CATALINA_BASE}/conf/catalina.policy"
fi
run start
Possible OPTIONS should be read outside of the block too?
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=H3lP9UbWQ1&a=cc_unsubscribe
8 years, 5 months
[Bug 1177153] New: zookeeper-lib-devel is missing
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1177153
Bug ID: 1177153
Summary: zookeeper-lib-devel is missing
Product: Fedora
Version: 21
Component: zookeeper
Assignee: tstclair(a)redhat.com
Reporter: fedora(a)famillecollet.com
QA Contact: extras-qa(a)fedoraproject.org
CC: ethan(a)ethantuttle.com,
java-sig-commits(a)lists.fedoraproject.org,
jeff(a)ocjtech.us, s(a)shk.io, tstclair(a)redhat.com
Up to Fedora 20 zookeeper-lib-devel was available.
I understand that zookeeper-devel provides the needed stuf.
I think zookeeper-devel have to obsoletes and provides zookeeper-lib-devel
And zookeeper have to obsoletes and provides zookeeper-lib
This will allow smoth update from Fedora < 21
And avoid having to conditionalize the BR in dependent packages
(even if I prefer the previous layout, which pull much less dependency)
P.S. I use this to build php-pecl-zookeper (but not yet submitted for Fedora
repo)
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6r7IOnjNPg&a=cc_unsubscribe
8 years, 6 months
[Bug 1217425] New: xmvn-builddep generates dependencies on artifacts in the reactor
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1217425
Bug ID: 1217425
Summary: xmvn-builddep generates dependencies on artifacts in
the reactor
Product: Fedora
Version: rawhide
Component: xmvn
Assignee: mizdebsk(a)redhat.com
Reporter: msimacek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
Description of problem:
xmvn-builddep sometimes unnecessarily generates dependency on artifacts from
the project itself, thus creating circular dependency.
Version-Release number of selected component (if applicable):
xmvn-2.4.0-0.28.git49333a9.noarch
How reproducible:
always
Steps to Reproduce:
1. rebuild log4j
2. run xmvn-builddep on the build.log
Actual results:
Unnecessary circular dependency:
BuildRequires: mvn(org.apache.logging.log4j:log4j-api)
BuildRequires: mvn(org.apache.logging.log4j:log4j-api::tests:)
BuildRequires: mvn(org.apache.logging.log4j:log4j-core)
BuildRequires: mvn(org.apache.logging.log4j:log4j-core::tests:)
BuildRequires: mvn(org.apache.logging.log4j:log4j:pom:)
BuildRequires: mvn(org.apache.logging.log4j:log4j-web)
Expected results:
No circular dependency.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IopQVXkuHY&a=cc_unsubscribe
8 years, 6 months
[Bug 1217422] New: xmvn-builddep: unexpanded variables in output
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1217422
Bug ID: 1217422
Summary: xmvn-builddep: unexpanded variables in output
Product: Fedora
Version: rawhide
Component: xmvn
Assignee: mizdebsk(a)redhat.com
Reporter: msimacek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
Description of problem:
xmvn-builddep sometimes outputs buildrequires with unexpanded variables
Version-Release number of selected component (if applicable):
xmvn-2.4.0-0.28.git49333a9.noarch
How reproducible:
always
Steps to Reproduce:
1. rebuild felix-bundlerepository
2. run xmvn-builddep on the build.log
Actual results:
BuildRequires: maven-local
BuildRequires: mvn(junit:junit)
BuildRequires: mvn(net.sf.kxml:kxml2)
BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)
BuildRequires: mvn(org.apache.rat:apache-rat-plugin)
BuildRequires: mvn(org.codehaus.woodstox:woodstox-core-asl)
BuildRequires: mvn(org.easymock:easymock)
BuildRequires: mvn(org.osgi:org.osgi.compendium)
BuildRequires: mvn(org.osgi:org.osgi.core)
BuildRequires: mvn(${project.groupId}:org.apache.felix.shell)
BuildRequires: mvn(${project.groupId}:org.apache.felix.utils)
BuildRequires: mvn(${project.groupId}:org.osgi.service.obr)
BuildRequires: mvn(xpp3:xpp3)
Expected results:
BuildRequires: maven-local
BuildRequires: mvn(junit:junit)
BuildRequires: mvn(net.sf.kxml:kxml2)
BuildRequires: mvn(org.apache.felix:maven-bundle-plugin)
BuildRequires: mvn(org.apache.rat:apache-rat-plugin)
BuildRequires: mvn(org.codehaus.woodstox:woodstox-core-asl)
BuildRequires: mvn(org.easymock:easymock)
BuildRequires: mvn(org.osgi:org.osgi.compendium)
BuildRequires: mvn(org.osgi:org.osgi.core)
BuildRequires: mvn(org.apache.felix:org.apache.felix.shell)
BuildRequires: mvn(org.apache.felix:org.apache.felix.utils)
BuildRequires: mvn(org.apache.felix:org.osgi.service.obr)
BuildRequires: mvn(xpp3:xpp3)
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=PQlXaYXPad&a=cc_unsubscribe
8 years, 6 months