java-sig-commits September 2015

java-sig-commits@lists.fedoraproject.org

3 participants
202 discussions

[Bug 1185148] New: CVE-2014-9634 Jenkins on Tomcat: failure to set secure flag on cookies
by Red Hat Bugzilla 15 Feb '16

15 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1185148 Bug ID: 1185148 Summary: CVE-2014-9634 Jenkins on Tomcat: failure to set secure flag on cookies Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: kseifried(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com Yann Rouillard reports: Jenkins on Tomcat fails to set the secure flag on cookies. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=gU5XTmvmU1&a=cc_unsubscribe

1 6

[Bug 1266067] New: log4j-2.4 is available
by Red Hat Bugzilla 15 Feb '16

15 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1266067 Bug ID: 1266067 Summary: log4j-2.4 is available Product: Fedora Version: rawhide Component: log4j Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: devrim(a)gunduz.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Latest upstream release: 2.4 Current version/release in rawhide: 2.3-2.fc23 URL: http://www.apache.org/dist/logging/log4j Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=4DdJOPciOO&a=cc_unsubscribe

1 9

[Bug 1185151] New: CVE-2014-9635 Jenkins on Tomcat: failure to set httponly flag on cookies
by Red Hat Bugzilla 15 Feb '16

15 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1185151 Bug ID: 1185151 Summary: CVE-2014-9635 Jenkins on Tomcat: failure to set httponly flag on cookies Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: kseifried(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com Yann Rouillard reports: Jenkins on Tomcat fails to set the httponly flag on cookies. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6JvfkFVyd4&a=cc_unsubscribe

1 7

[Bug 1098412] New: pax-logging: Bundles code from other logging libraries
by Red Hat Bugzilla 07 Feb '16

07 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1098412 Bug ID: 1098412 Summary: pax-logging: Bundles code from other logging libraries Product: Fedora Version: rawhide Component: pax-logging Assignee: puntogil(a)libero.it Reporter: fweimer(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Blocks: 1098237 pax-logging-1.6.9-8.fc21.noarch bundles class files from other Fedora packages in its JAR files, e.g. org/slf4j/ILoggerFactory (from slf4j-0:1.7.7-1.fc21.noarch), org/apache/log4j/helpers/ThreadLocalMap (from log4j-0:1.2.17-16.fc21.noarch), and some OSGI-related classes like org/osgi/service/log/LogEntry whose main package is a bit unclear. This is against the Fedora packaging guidelines, specifically <http://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries>. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1098237 [Bug 1098237] Java "static linking"/class bundling in Fedora -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=DUsKDiC5iv&a=cc_unsubscribe

1 6

[Bug 1140314] New: CVE-2013-4444 tomcat: remote code execution via uploaded JSP
by Red Hat Bugzilla 07 Feb '16

07 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1140314 Bug ID: 1140314 Summary: CVE-2013-4444 tomcat: remote code execution via uploaded JSP Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: vdanen(a)redhat.com CC: akurtako(a)redhat.com, dknox(a)redhat.com, gmurphy(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jclere(a)redhat.com, jdoyle(a)redhat.com, krzysztof.daniel(a)gmail.com, lgao(a)redhat.com, myarboro(a)redhat.com, pslavice(a)redhat.com, rsvoboda(a)redhat.com, weli(a)redhat.com As reported fixed in Apache Tomcat 7.0.40 [1]: In very limited circumstances, it was possible for an attacker to upload a malicious JSP to a Tomcat server and then trigger the execution of that JSP. While Remote Code Execution would normally be viewed as a critical vulnerability, the circumstances under which this is possible are, in the view of the Tomcat security team, sufficiently limited that this vulnerability is viewed as important. For this attack to succeed all of the following requirements must be met: 1. Using Oracle Java 1.7.0 update 25 or earlier (or any other Java implementation where java.io.File is vulnerable to null byte injection). 2. A web application must be deployed to a vulnerable version of Tomcat. 3. The web application must use the Servlet 3.0 File Upload feature. 4. A file location within a deployed web application must be writeable by the user the Tomcat process is running as. The Tomcat security documentation recommends against this. 5. A custom listener for JMX connections (e.g. the JmxRemoteListener that is not enabled by default) must be configured and be able to load classes from Tomcat's common class loader (i.e. the custom JMX listener must be placed in Tomcat's lib directory). 6. The custom JMX listener must be bound to an address other than localhost for a remote attack (it is bound to localhost by default). If the custom JMX listener is bound to localhost, a local attack will still be possible. Note that requirements 2 and 3 may be replaced with the following requirement: 7. A web application is deployed that uses Apache Commons File Upload 1.2.1 or earlier. In this case (requirements 1, 4, 5, 6 and 7 met) a similar vulnerability may exist on any Servlet container, not just Apache Tomcat. This was fixed in revision 1470437. [2] (April 22, 2013) This issue was identified by Pierre Ernst of the VMware Security Engineering, Communications and Response group (vSECR) and reported to the Tomcat security team via the Pivotal security team on 5 September 2014. It was made public on 10 September 2014. Affects: 7.0.0 to 7.0.39 [1] http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.40 [2] http://svn.apache.org/viewvc?view=revision&revision=1470437 Statement: This issue did not affect the versions of tomcat as shipped with Red Hat Enterprise Linux 5, 6, or 7 nor the versions of tomcat as shipped with JBoss Enterprise Web Server. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=NIGlAdEiPm&a=cc_unsubscribe

1 9

[Bug 1203652] New: tomcat: Duplicate Maven metadata for tomcat-jdbc
by Red Hat Bugzilla 04 Feb '16

04 Feb '16

https://bugzilla.redhat.com/show_bug.cgi?id=1203652 Bug ID: 1203652 Summary: tomcat: Duplicate Maven metadata for tomcat-jdbc Product: Fedora Version: 22 Component: tomcat Keywords: Regression Assignee: ivan.afonichev(a)gmail.com Reporter: mizdebsk(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com, sgallagh(a)redhat.com Description of problem: Tomcat installs duplicate metadata for tomcat-jdbc Maven artifact. Version-Release number of selected component (if applicable): 7.0.59-3 Steps to Reproduce: xmvn-resolve org.apache.tomcat:tomcat-jdbc Actual results: [WARNING] Ignoring metadata for artifact org.apache.tomcat:tomcat-jdbc:jar:SYSTEM as it has duplicate metadata [WARNING] Ignoring metadata for artifact org.apache.tomcat:tomcat-jdbc:pom:SYSTEM as it has duplicate metadata [ERROR] Unable to resolve artifact org.apache.tomcat:tomcat-jdbc:jar:SYSTEM Expected results: /usr/share/java/tomcat/tomcat-jdbc.jar Additional info: Regression was introduced in: commit ce74ddbcd3beba22fb70cd2dc890efa7409bf97f Author: Stephen Gallagher <sgallagh(a)redhat.com> Date: Tue Mar 3 14:58:21 2015 -0500 Revert to Tomcat 7 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=wfJxJ9VXJ8&a=cc_unsubscribe

1 6

[Bug 1004916] New: Package doesn't provide a sysvinit script or systemd service unit
by Red Hat Bugzilla 28 Jan '16

28 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1004916 Bug ID: 1004916 Summary: Package doesn't provide a sysvinit script or systemd service unit Product: Fedora Version: 19 Component: activemq Severity: high Assignee: mspaulding06(a)gmail.com Reporter: skottler(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: agrimm(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mspaulding06(a)gmail.com, tdawson(a)redhat.com Description of problem: activemq doesn't provide the necessary scripts/config files to start. Version-Release number of selected component (if applicable): 0:5.6.0-5.fc19 How reproducible: Always. Steps to Reproduce: 1. yum install -y activemq activemq-core 2. try starting the service 3. note there is not a service unit This seems like a fairly major thing to be missing in the packages. Is there another package or metapackage that needs to be installed for it to work? -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IC3tNZ0uDP&a=cc_unsubscribe

1 15

[Bug 1205627] New: CVE-2015-1810 jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166)
by Red Hat Bugzilla 26 Jan '16

26 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1205627 Bug ID: 1205627 Summary: CVE-2015-1810 jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com For users using "'Jenkins' own user database" setting, Jenkins doesn't refuse reserved names, thus allowing privilege escalation. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=KqlcbN0dDQ&a=cc_unsubscribe

1 15

[Bug 1205622] New: CVE-2015-1807 jenkins: directory traversal from artifacts via symlink (SECURITY-162)
by Red Hat Bugzilla 26 Jan '16

26 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1205622 Bug ID: 1205622 Summary: CVE-2015-1807 jenkins: directory traversal from artifacts via symlink (SECURITY-162) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com This vulnerability allows users with the job configuration privilege or users with commit access to the build script to access arbitrary files/directories on the master, resulting in the exposure of sensitive information, such as encryption keys. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=vs9xNW7rJ9&a=cc_unsubscribe

1 15

[Bug 1205620] New: CVE-2015-1806 jenkins: Combination filter Groovy script unsecured (SECURITY-125)
by Red Hat Bugzilla 26 Jan '16

26 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1205620 Bug ID: 1205620 Summary: CVE-2015-1806 jenkins: Combination filter Groovy script unsecured (SECURITY-125) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com This vulnerability allows users with the job configuration privilege to escalate his privileges, resulting in arbitrary code execution to the master. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=G0xWdXgoFw&a=cc_unsubscribe

1 15

← Newer
1
...
5
6
7
8
9
10
11
...
21
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits September 2015