[Bug 1311952] New: CVE-2016-0792 jenkins: Remote code execution through remote API (SECURITY-247) [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1311952
Bug ID: 1311952
Summary: CVE-2016-0792 jenkins: Remote code execution through
remote API (SECURITY-247) [fedora-all]
Product: Fedora
Version: 23
Component: jenkins
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: msrb(a)redhat.com
Reporter: anemec(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Blocks: 1311950 (CVE-2016-0792)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1311950
[Bug 1311950] CVE-2016-0792 jenkins: Remote code execution through remote
API (SECURITY-247)
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month
[Bug 1311132] New: Error using Cobertura plugin with Fedora 23 jenkins
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1311132
Bug ID: 1311132
Summary: Error using Cobertura plugin with Fedora 23 jenkins
Product: Fedora
Version: 23
Component: jenkins
Severity: medium
Assignee: msrb(a)redhat.com
Reporter: aconole(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Description of problem:
Cobertura plugin fails with the fedora23 bundled jenkins
Version-Release number of selected component (if applicable):
Jenkins - 1.625.3
Cobertura plugin - 1.9.7
How reproducible:
Very
Steps to Reproduce:
1. installed jenkins from the Fedora 23 repository.
2. installed cobertura plugin, and git client plugin
3. Added a single job building a c/makefile project (openvswitch).
4. Used gcovr to make a cobertura coverage.xml file from the unit test output
5. Added 'Publish Cobertura Coverage results' post-build action
Actual results:
Got the following exception:
Running gcov: 'gcov
/var/lib/jenkins/jobs/openvswitch-build/workspace/lib/dirs.gcda --branch-counts
--branch-probabilities --preserve-paths --object-directory
/var/lib/jenkins/jobs/openvswitch-build/workspace/lib' in
'/var/lib/jenkins/jobs/openvswitch-build/workspace/lib'
Parsing coverage data for file
/var/lib/jenkins/jobs/openvswitch-build/workspace/lib/dirs.c.in
Parsing coverage data for file
/var/lib/jenkins/jobs/openvswitch-build/workspace/include/openvswitch/thread.h
Gathered coveraged data for 302 files
[Cobertura] Publishing Cobertura coverage report...
ERROR: Step ‘Publish Cobertura Coverage Report’ aborted due to exception:
java.lang.NoClassDefFoundError: org/codehaus/stax2/XMLInputFactory2
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:760)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:467)
at java.net.URLClassLoader.access$100(URLClassLoader.java:73)
at java.net.URLClassLoader$1.run(URLClassLoader.java:368)
at java.net.URLClassLoader$1.run(URLClassLoader.java:362)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:361)
at
org.eclipse.jetty.webapp.WebAppClassLoader.loadClass(WebAppClassLoader.java:421)
at
org.eclipse.jetty.webapp.WebAppClassLoader.loadClass(WebAppClassLoader.java:383)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:348)
at java.util.ServiceLoader$LazyIterator.nextService(ServiceLoader.java:370)
at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:404)
at java.util.ServiceLoader$1.next(ServiceLoader.java:480)
at javax.xml.stream.FactoryFinder$1.run(FactoryFinder.java:353)
at java.security.AccessController.doPrivileged(Native Method)
at javax.xml.stream.FactoryFinder.findServiceProvider(FactoryFinder.java:341)
at javax.xml.stream.FactoryFinder.find(FactoryFinder.java:313)
at javax.xml.stream.FactoryFinder.find(FactoryFinder.java:227)
at javax.xml.stream.XMLInputFactory.newInstance(XMLInputFactory.java:154)
at
hudson.plugins.cobertura.CoberturaPublisher$ParseReportCallable.invoke(CoberturaPublisher.java:538)
at
hudson.plugins.cobertura.CoberturaPublisher$ParseReportCallable.invoke(CoberturaPublisher.java:525)
at hudson.FilePath.act(FilePath.java:991)
at hudson.FilePath.act(FilePath.java:969)
at
hudson.plugins.cobertura.CoberturaPublisher.perform(CoberturaPublisher.java:343)
at hudson.tasks.BuildStepMonitor$3.perform(BuildStepMonitor.java:45)
at
hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:785)
at
hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:726)
at hudson.model.Build$BuildExecution.post2(Build.java:185)
at
hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:671)
at hudson.model.Run.execute(Run.java:1766)
at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
at hudson.model.ResourceController.execute(ResourceController.java:98)
at hudson.model.Executor.run(Executor.java:408)
Caused by: java.lang.ClassNotFoundException:
org.codehaus.stax2.XMLInputFactory2
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at
org.eclipse.jetty.webapp.WebAppClassLoader.loadClass(WebAppClassLoader.java:430)
at
org.eclipse.jetty.webapp.WebAppClassLoader.loadClass(WebAppClassLoader.java:383)
... 36 more
Finished: FAILURE
Expected results:
Cobertura plugin would be able to run with all dependencies satisfied
Additional info:
Installing Jenkins from the official repo fixed this problem.
I tried the following (before making that change):
* Modifying the cobertura plugin pom.xml to include the stax2 dependency
* Adding the stax2 jar contents to the plugin classes/ directory
* Adding the stax2 jar to the plugin lib/ directory
* Uninstalling/reinstalling the cobertura plugin
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month
[Bug 1317522] New: CVE-2016-0734 CVE-2016-0782 activemq: various flaws [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1317522
Bug ID: 1317522
Summary: CVE-2016-0734 CVE-2016-0782 activemq: various flaws
[fedora-all]
Product: Fedora
Version: 23
Component: activemq
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: puntogil(a)libero.it
Reporter: amaris(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: agrimm(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it, s(a)shk.io, tdawson(a)redhat.com
Blocks: 1317516 (CVE-2016-0782), 1317520 (CVE-2016-0734)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1317516
[Bug 1317516] CVE-2016-0782 activemq: Cross-site scripting vulnerabilities
in web console
https://bugzilla.redhat.com/show_bug.cgi?id=1317520
[Bug 1317520] CVE-2016-0734 activemq: Clickjacking in Web Console
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month
[Bug 1315677] New: jenkins-remoting-2.56 is available
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1315677
Bug ID: 1315677
Summary: jenkins-remoting-2.56 is available
Product: Fedora
Version: rawhide
Component: jenkins-remoting
Keywords: FutureFeature, Triaged
Assignee: msrb(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Latest upstream release: 2.56
Current version/release in rawhide: 2.55-1.fc25
URL: https://github.com/jenkinsci/remoting
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month
[Bug 1129074] CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1129074
Pavel Polischouk <pavelp(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|40818,reported=20140812,sou |40818,reported=20140812,sou
|rce=upstream,cvss2=5.8/AV:N |rce=upstream,cvss2=5.8/AV:N
|/AC:M/Au:N/C:P/I:P/A:N,cwe= |/AC:M/Au:N/C:P/I:P/A:N,cwe=
|CWE-297,rhel-5/jakarta-comm |CWE-297,rhel-5/jakarta-comm
|ons-httpclient=affected,rhe |ons-httpclient=affected,rhe
|l-6/jakarta-commons-httpcli |l-6/jakarta-commons-httpcli
|ent=affected,rhel-7/jakarta |ent=affected,rhel-7/jakarta
|-commons-httpclient=affecte |-commons-httpclient=affecte
|d,fedora-all/jakarta-common |d,fedora-all/jakarta-common
|s-httpclient=affected,rhel- |s-httpclient=affected,rhel-
|7/httpcomponents-client=aff |7/httpcomponents-client=aff
|ected,fedora-all/httpcompon |ected,fedora-all/httpcompon
|ents-client=affected,brms-6 |ents-client=affected,brms-6
|/httpclient=affected,bpms-6 |/httpclient=affected,bpms-6
|/httpclient=affected,brms-6 |/httpclient=affected,brms-6
|/jakarta-commons-httpclient |/jakarta-commons-httpclient
|=affected,bpms-6/jakarta-co |=affected,bpms-6/jakarta-co
|mmons-httpclient=affected,j |mmons-httpclient=affected,j
|dg-6/httpclient=affected,jd |dg-6/httpclient=affected,jd
|v-6/modeshape-client=defer, |v-6/modeshape-client=defer,
|jdv-6/httpclient=affected,d |jdv-6/httpclient=affected,d
|ts-2.1/httpcomponents-clien |ts-2.1/httpcomponents-clien
|t=notaffected,eap-4/jakarta |t=notaffected,eap-4/jakarta
|-commons-httpclient=wontfix |-commons-httpclient=wontfix
|,eap-5/httpclient=affected, |,eap-5/httpclient=affected,
|eap-5/jakarta-commons-httpc |eap-5/jakarta-commons-httpc
|lient=affected,eap-6/httpcl |lient=affected,eap-6/httpcl
|ient=affected,eap-6/jakarta |ient=affected,eap-6/jakarta
|-commons-httpclient=defer,e |-commons-httpclient=defer,e
|pp-5/httpclient=affected,ep |pp-5/httpclient=affected,ep
|p-5/jakarta-commons-httpcli |p-5/jakarta-commons-httpcli
|ent=affected,brms-5/httpcli |ent=affected,brms-5/httpcli
|ent=affected,brms-5/jakarta |ent=wontfix,brms-5/jakarta-
|-commons-httpclient=affecte |commons-httpclient=wontfix,
|d,brms-5/modeshape-client=a |brms-5/modeshape-client=won
|ffected,soap-4.3/jakarta-co |tfix,soap-4.3/jakarta-commo
|mmons-httpclient=wontfix,so |ns-httpclient=wontfix,soap-
|ap-5/httpclient=affected,so |5/httpclient=affected,soap-
|ap-5/jakarta-commons-httpcl |5/jakarta-commons-httpclien
|ient=affected,jbews-1/jakar |t=affected,jbews-1/jakarta-
|ta-commons-httpclient=wontf |commons-httpclient=wontfix,
|ix,fsw-6/httpclient=affecte |fsw-6/httpclient=affected,j
|d,jon-3/httpclient=affected |on-3/httpclient=affected,jo
|,jon-3/jakarta-commons-http |n-3/jakarta-commons-httpcli
|client=affected,jpp-6/httpc |ent=affected,jpp-6/httpclie
|lient=affected,wfk-2/httpcl |nt=affected,wfk-2/httpclien
|ient=affected,openshift-ent |t=affected,openshift-enterp
|erprise-1/wagon-http=notaff |rise-1/wagon-http=notaffect
|ected,openshift-enterprise- |ed,openshift-enterprise-2/w
|2/wagon-http=notaffected,op |agon-http=notaffected,opens
|enshift-enterprise-1/jakart |hift-enterprise-1/jakarta-c
|a-commons-httpclient=wontfi |ommons-httpclient=wontfix,o
|x,openshift-enterprise-2/ja |penshift-enterprise-2/jakar
|karta-commons-httpclient=af |ta-commons-httpclient=affec
|fected,openshift-enterprise |ted,openshift-enterprise-2/
|-2/httpclient=affected,rhev |httpclient=affected,rhev-m-
|-m-3/jasperreports-server-p |3/jasperreports-server-pro=
|ro=affected,rhev-m-3.4/rhev |affected,rhev-m-3.4/rhevm-d
|m-dependencies=wontfix,rhev |ependencies=wontfix,rhev-m-
|-m-3.5/rhevm-dependencies=a |3.5/rhevm-dependencies=affe
|ffected,rhev-m-3/redhat-sup |cted,rhev-m-3/redhat-suppor
|port-plugin-rhev=affected,r |t-plugin-rhev=affected,rhn_
|hn_satellite_6/httpcomponen |satellite_6/httpcomponents-
|ts-client=affected,rhn_sate |client=affected,rhn_satelli
|llite_5/jakarta-commons-htt |te_5/jakarta-commons-httpcl
|pclient=wontfix,rhscl-1/the |ient=wontfix,rhscl-1/thermo
|rmostat1-httpcomponents-cli |stat1-httpcomponents-client
|ent=affected,rhscl-1/maven3 |=affected,rhscl-1/maven30-h
|0-httpcomponents-client=aff |ttpcomponents-client=affect
|ected,rhscl-1/maven30-jakar |ed,rhscl-1/maven30-jakarta-
|ta-commons-httpclient=affec |commons-httpclient=affected
|ted,rhes-2.1/rhevm-dependen |,rhes-2.1/rhevm-dependencie
|cies=wontfix,rhes-3.0/rhevm |s=wontfix,rhes-3.0/rhevm-de
|-dependencies=wontfix,jboss |pendencies=wontfix,jboss/ew
|/ewp-5=affected,jboss/fuse- |p-5=affected,jboss/fuse-esb
|esb-4=wontfix,jboss/fuse-es |-4=wontfix,jboss/fuse-esb-7
|b-7=affected,jboss/fuse-mq- |=affected,jboss/fuse-mq-5.4
|5.4=wontfix,jboss/fuse-mq-5 |=wontfix,jboss/fuse-mq-5.5=
|.5=affected,jboss/fuse-mq-7 |affected,jboss/fuse-mq-7=af
|=affected,jboss/fsf-2=wontf |fected,jboss/fsf-2=wontfix,
|ix,jboss/amq-6=affected,jbo |jboss/amq-6=affected,jboss/
|ss/jds-5=defer,jboss/jds-6= |jds-5=defer,jboss/jds-6=def
|defer,jboss/jds-7=defer,jbo |er,jboss/jds-7=defer,jboss/
|ss/fuse-6=affected,eds-5/mo |fuse-6=affected,brms-5/cxf=
|deshape-client=defer,brms-5 |affected,brms-6/cxf=affecte
|/cxf=affected,brms-6/cxf=af |d,bpms-6/cxf=affected,soap-
|fected,bpms-6/cxf=affected, |5/cxf=affected,fsw-6/cxf=af
|soap-5/cxf=affected,fsw-6/c |fected,eds-5/cxf=affected,j
|xf=affected,eds-5/cxf=affec |dv-6/cxf=affected,eap-5/cxf
|ted,jdv-6/cxf=affected,eap- |=affected,eap-6/cxf=affecte
|5/cxf=affected,eap-6/cxf=af |d,jon-3/cxf=affected,jpp-6/
|fected,jon-3/cxf=affected,j |cxf=affected,jdg-6/cxf=affe
|pp-6/cxf=affected,jdg-6/cxf |cted,eds-5/httpclient=affec
|=affected,eds-5/httpclient= |ted
|affected |
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month