[Bug 1236297] New: log4j not working
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1236297
Bug ID: 1236297
Summary: log4j not working
Product: Fedora
Version: 22
Component: tomcat
Severity: low
Assignee: ivan.afonichev(a)gmail.com
Reporter: edwardquick(a)hotmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
Description of problem:
After configuring tomcat to work with log4j, there are no logs.
Version-Release number of selected component (if applicable):
tomcat-7.0.59-4.fc22.noarch
tomcat-log4j-7.0.59-4.fc22.noarch
How reproducible:
Always
Steps to Reproduce:
1. dnf install tomcat tomcat-log4j
2. cp /etc/tomcat/log4j.properties /usr/share/tomcat/lib/log4j.properties
3. cp /usr/share/java/tomcat/log4j.jar /usr/share/tomcat/lib
4. echo "LOGGING_PROPERTIES=/usr/share/tomcat/lib/log4j.properties" >
/etc/tomcat/tomcat.conf
5. systemctl start tomcat
Actual results:
tomcat.log does not exist in /var/log/tomcat
Expected results:
tomcat.log should exist in /var/log/tomcat with debug logging
Additional info:
I followed the information at
https://tomcat.apache.org/tomcat-7.0-doc/logging.html#Using_Log4j and got this
to work by replacing tomcat-juli.jar in /usr/share/tomcat/bin and adding
tomcat-juli-adapaters.jar to /usr/share/tomcat/lib
Here is the tomcat process I ran
[root@fedora22 lib]# ps -ef | grep java
tomcat 4128 31665 4 12:54 pts/0 00:00:02 /usr/lib/jvm/jre/bin/java
-classpath
/usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/lib/java/commons-daemon.jar
-Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat
-Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp
-Djava.util.logging.config.file=/usr/share/tomcat/lib/log4j.properties
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
org.apache.catalina.startup.Bootstrap start
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=52EFloyjfz&a=cc_unsubscribe
8 years, 2 months
[Bug 1302718] New: user 'tomcat': program '/bin/nologin' does not exist
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1302718
Bug ID: 1302718
Summary: user 'tomcat': program '/bin/nologin' does not exist
Product: Fedora
Version: 22
Component: tomcat
Severity: low
Assignee: ivan.afonichev(a)gmail.com
Reporter: daveg(a)dgit.me.uk
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
Description of problem:
Minor niggle!
The tomcat UID specifies '/bin/nologin' as it's shell. That does not exist in a
standard installation and should be '/sbin/nologin'.
Version-Release number of selected component (if applicable):
Historical through rawhide.
How reproducible:
Always.
Steps to Reproduce:
1. Install.
2. Run pwck.
Actual results:
user 'tomcat': program '/bin/nologin' does not exist
Expected results:
No errors or warnings.
Additional info:
http://pkgs.fedoraproject.org/cgit/rpms/tomcat.git/tree/tomcat.spec#n527
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 2 months
[Bug 1311771] New: Tomcat 8.0.32 update breaks FreeIPA and Dogtag installations
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1311771
Bug ID: 1311771
Summary: Tomcat 8.0.32 update breaks FreeIPA and Dogtag
installations
Product: Fedora
Version: 23
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: nkinder(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
Created attachment 1130367
--> https://bugzilla.redhat.com/attachment.cgi?id=1130367&action=edit
journal snippet
The tomcat-8.0.32-3.fc23 update in updates-testing will break all existing
FreeIPA and Dogtag installations. It appears that this update moves some
classes around between jar files, which will cause a restart of the
tomcat-based FreeIPA and Dogtag services to fail with a class loader error. I
have attached a snippet from the system journal showing the failure.
Since this change is not backwards compatible and will break many
installations, I think we should not be moving these classes around in F23. We
can adjust code on the Dogtag side for F24 to deal with these new locations
since it is still pre-alpha release.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 2 months
[Bug 1311905] New: tomcat-8.0.32: tomcat version fails with load error org.apache.catalina.util.ServerInfo
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1311905
Bug ID: 1311905
Summary: tomcat-8.0.32: tomcat version fails with load error
org.apache.catalina.util.ServerInfo
Product: Fedora
Version: rawhide
Component: tomcat
Severity: high
Assignee: ivan.afonichev(a)gmail.com
Reporter: cheimes(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
External Bug ID: Red Hat Bugzilla 1311771
Description of problem:
The command 'tomcat version' fails on rawhide.
Version-Release number of selected component (if applicable):
tomcat-8.0.32-2.fc24
How reproducible:
Always
Steps to Reproduce:
1. install tomcat
2. run 'tomcat version'
Actual results:
Error: Could not find or load main class org.apache.catalina.util.ServerInfo
Expected results:
Tomcat's version information
Additional info:
It looks like tomcat can't load the class because CATALINA_HOME is not set. The
issue is related to #1311771 and also blocks FreeIPA and Dogtag PKI.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 2 months
[Bug 1282371] New: jenkins: Remote code execution vulnerability due to unsafe deserialization in Jenkins remoting (SECURITY-218)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282371
Bug ID: 1282371
Summary: jenkins: Remote code execution vulnerability due to
unsafe deserialization in Jenkins remoting
(SECURITY-218)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
Unsafe deserialization allows unauthenticated remote attackers to run arbitrary
code on the Jenkins master.
This flaw could allow unauthenticated remote attackers to run arbitrary code on
Jenkins.
Mitigation:
https://jenkins-ci.org/content/mitigating-unauthenticated-remote-code-exe...
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=cAmrN8IiEj&a=cc_unsubscribe
8 years, 2 months
[Bug 1282369] New: CVE-2015-5326 jenkins: Stored XSS vulnerability in slave offline status message (SECURITY-214)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282369
Bug ID: 1282369
Summary: CVE-2015-5326 jenkins: Stored XSS vulnerability in
slave offline status message (SECURITY-214)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
Users with the permission to take slave nodes offline can enter arbitrary HTML
that gets shown unescaped to users visiting the slave overview page.
This flaw allows admins and users with significant privileges to circumvent XSS
protection.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ModxPFNrI9&a=cc_unsubscribe
8 years, 2 months
[Bug 1282368] New: CVE-2015-5325 jenkins: JNLP slaves not subject to slave-to-master access control (SECURITY-206)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282368
Bug ID: 1282368
Summary: CVE-2015-5325 jenkins: JNLP slaves not subject to
slave-to-master access control (SECURITY-206)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
Slaves connecting via JNLP were not subject to the optional slave-to-master
access control documented at http://jenkins-ci.org/security-144
(CVE-2014-3665).
This flaw allows to circumvent the major protection against less trusted node
admins.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IK7A2heIu9&a=cc_unsubscribe
8 years, 2 months
[Bug 1282367] New: CVE-2015-5324 jenkins: Queue API did show items not visible to the current user (SECURITY-186)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282367
Bug ID: 1282367
Summary: CVE-2015-5324 jenkins: Queue API did show items not
visible to the current user (SECURITY-186)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
The /queue/api URL could return information about items not accessible to the
current user (such as parameter names and values, build names, project
descriptions, ...).
Low privileged users can gain some limited information about items they should
not have access to.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=43JguXYsQ1&a=cc_unsubscribe
8 years, 2 months
[Bug 1282366] New: CVE-2015-5323 jenkins: API tokens of other users available to admins (SECURITY-200)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282366
Bug ID: 1282366
Summary: CVE-2015-5323 jenkins: API tokens of other users
available to admins (SECURITY-200)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
API tokens of other users were exposed to admins by default. On instances that
don't implicitly grant RunScripts permission to admins, this allowed admins to
run scripts with another user's credentials.
In very specific circumstances, it allows admins to gain permissions they would
not otherwise have.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=ZqXJZdyVqX&a=cc_unsubscribe
8 years, 2 months
[Bug 1282365] New: CVE-2015-5322 jenkins: Local file inclusion vulnerability (SECURITY-195)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1282365
Bug ID: 1282365
Summary: CVE-2015-5322 jenkins: Local file inclusion
vulnerability (SECURITY-195)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com
The following flaw was found in Jenkins:
Access to the /jnlpJars/ URL was not limited to the specific JAR files users
needed to access, allowing browsing directories and downloading other files in
the Jenkins servlet resources, such as web.xml.
The information gained is very limited, and it requires a specific setup to
gain any non-public information this way.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IMdsIBEfX4&a=cc_unsubscribe
8 years, 2 months