[Bug 1403824] New: CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1403824
Bug ID: 1403824
Summary: CVE-2016-8745 tomcat: information disclosure due to
incorrect Processor sharing
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, aszczucz(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
ccoleman(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
dosoudil(a)redhat.com, etirelli(a)redhat.com,
felias(a)redhat.com, fnasser(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, huwang(a)redhat.com,
ivan.afonichev(a)gmail.com, jason.greene(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jshepherd(a)redhat.com,
kconner(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lmeyer(a)redhat.com,
lpetrovi(a)redhat.com, mbabacek(a)redhat.com,
mbaluch(a)redhat.com, me(a)coolsvap.net,
miburman(a)redhat.com, mmccomas(a)redhat.com,
mwinkler(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
trick(a)vanstaveren.us, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
The following flaw was found in Apache Tomcat:
The refactoring of the Connector code for 8.5.x onwards introduced a regression
in the error handling of the send file code for the NIO HTTP connector. An
error during send file processing resulted in the current Processor object
being added to the Processor cache multiple times. This in turn meant that the
same Processor could be used for concurrent requests. Sharing a Processor can
result in information leakage between requests including, not limited to,
session ID and the response body.
This issue affects only versions 8.5.x and later.
Upstream patch:
8.x: https://svn.apache.org/viewvc?view=revision&revision=1771857
9.x: https://svn.apache.org/viewvc?view=revision&revision=1771853
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1294230] New: Please provide support for EPEL7
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1294230
Bug ID: 1294230
Summary: Please provide support for EPEL7
Product: Fedora
Version: rawhide
Component: powermock
Severity: medium
Assignee: rkennke(a)redhat.com
Reporter: projects.rg(a)smart.ms
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, msimacek(a)redhat.com,
neugens(a)redhat.com, projects.rg(a)smart.ms,
rkennke(a)redhat.com
Description of problem:
There are packages for EPEL6 and 5. Please apply it also for EPEL7.
Version-Release number of selected component (if applicable):
-
How reproducible:
yes
Steps to Reproduce:
1. run an EPEL7 system
2. dnf install powermock
3.
Actual results:
no package found.
Expected results:
powermock gets installed with success.
Additional info:
DEBUG util.py:393: Getting requirements for powermock-1.6.2-2.el7.src
DEBUG util.py:393: --> maven-local-3.4.1-11.el7.noarch
DEBUG util.py:393: --> apache-commons-logging-1.1.2-7.el7.noarch
DEBUG util.py:393: --> tomcat-servlet-3.0-api-7.0.54-2.el7_1.noarch
DEBUG util.py:393: --> junit-4.11-8.el7.noarch
DEBUG util.py:393: --> cglib-2.2-18.el7.noarch
DEBUG util.py:393: --> maven-plugin-bundle-2.3.7-12.el7.noarch
DEBUG util.py:393: --> javassist-3.16.1-10.el7.noarch
DEBUG util.py:393: --> mockito-1.9.0-19.el7.noarch
DEBUG util.py:393: --> mockito-1.9.0-19.el7.noarch
DEBUG util.py:393: --> objenesis-1.2-18.el7.noarch
DEBUG util.py:393: --> sonatype-oss-parent-7-6.el7.noarch
DEBUG util.py:393: Error: No Package found for mvn(cglib:cglib-nodep)
DEBUG util.py:393: Error: No Package found for mvn(org.easymock:easymock)
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=GemvJMgqTe&a=cc_unsubscribe
6 years, 11 months
[Bug 1377280] New: CVE-2016-5017 zookeeper: Buffer overflow vulnerability in C cli shell
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1377280
Bug ID: 1377280
Summary: CVE-2016-5017 zookeeper: Buffer overflow vulnerability
in C cli shell
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, aszczucz(a)redhat.com,
chazlett(a)redhat.com, ctubbsii(a)fedoraproject.org,
dmcphers(a)redhat.com, ethan(a)ethantuttle.com,
etirelli(a)redhat.com, felias(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jialiu(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lmeyer(a)redhat.com, lpetrovi(a)redhat.com,
mbaluch(a)redhat.com, mmccomas(a)redhat.com,
mwinkler(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, rrajasek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com, s(a)shk.io,
tcunning(a)redhat.com, tiwillia(a)redhat.com,
tkirby(a)redhat.com, tstclair(a)redhat.com,
vhalbert(a)redhat.com
The ZooKeeper C client shells "cli_st" and "cli_mt" have a buffer overflow
vulnerability associated with parsing of the input command when using the
"cmd:<cmd>" batch mode syntax. If the command string exceeds 1024 characters a
buffer overflow will occur. There is no known compromise which takes advantage
of this vulnerability, and if security is enabled the attacker would be limited
by client level security constraints. The C cli shell is intended as a
sample/example of how to use the C client interface, not as a production tool -
the documentation has also been clarified on this point.
References:
http://seclists.org/bugtraq/2016/Sep/29
Upstream fix:
https://git-wip-us.apache.org/repos/asf?p=zookeeper.git;a=commitdiff;h=27...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 12 months