[Bug 1317520] New: CVE-2016-0734 activemq: Clickjacking in Web Console
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1317520
Bug ID: 1317520
Summary: CVE-2016-0734 activemq: Clickjacking in Web Console
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, agrimm(a)redhat.com,
aileenc(a)redhat.com, ccoleman(a)redhat.com,
chazlett(a)redhat.com, dmcphers(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
ldimaggi(a)redhat.com, lmeyer(a)redhat.com,
mmccomas(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, puntogil(a)libero.it,
rwagner(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com, s(a)shk.io,
tcunning(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com, tkirby(a)redhat.com
It was reported that the web based administration console does not set the
X-Frame-Options header in HTTP responses. This allows the console to be
embedded in a frame or iframe which could then be used to cause a user to
perform an unintended action in the console.
Affected versions: Apache ActiveMQ 5.0.0 - 5.13.1
External Reference:
http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announc...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 11 months
[Bug 1317516] New: CVE-2016-0782 activemq: Cross-site scripting vulnerabilities in web console
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1317516
Bug ID: 1317516
Summary: CVE-2016-0782 activemq: Cross-site scripting
vulnerabilities in web console
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, agrimm(a)redhat.com,
aileenc(a)redhat.com, ccoleman(a)redhat.com,
chazlett(a)redhat.com, dmcphers(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
ldimaggi(a)redhat.com, lmeyer(a)redhat.com,
mmccomas(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, puntogil(a)libero.it,
rwagner(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com, s(a)shk.io,
tcunning(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com, tkirby(a)redhat.com
Several instances of cross-site scripting vulnerabilities were identified to be
present in the web based administration console as well as the ability to
trigger a Java memory dump into an arbitrary folder. The root cause of these
issues are improper user data output validation and incorrect permissions
configured on Jolokia.
Affected versions: ActiveMQ 5.0.0 - 5.13.1
External Reference:
http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announc...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 11 months
[Bug 1327049] New: Latest maven-archiver update breaks maven-bundle-plugin
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1327049
Bug ID: 1327049
Summary: Latest maven-archiver update breaks
maven-bundle-plugin
Product: Fedora
Version: rawhide
Component: maven-archiver
Assignee: msrb(a)redhat.com
Reporter: sgehwolf(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Description of problem:
It breaks a couple of koshei builds:
https://apps.fedoraproject.org/koschei/package/jline
https://apps.fedoraproject.org/koschei/package/netty
Version-Release number of selected component (if applicable):
maven-archiver-3.0.1-1.fc25
Actual results:
[ERROR] Failed to execute goal
org.apache.felix:maven-bundle-plugin:3.0.1:manifest (default) on project jline:
Execution default of goal org.apache.felix:maven-bundle-plugin:3.0.1:manifest
failed: An API incompatibility was encountered while executing
org.apache.felix:maven-bundle-plugin:3.0.1:manifest:
java.lang.NoSuchMethodError:
org.apache.maven.archiver.MavenArchiver.getManifest(Lorg/apache/maven/project/MavenProject;Lorg/apache/maven/archiver/MavenArchiveConfiguration;)Lorg/codehaus/plexus/archiver/jar/Manifest;
[ERROR] -----------------------------------------------------
[ERROR] realm = plugin>org.apache.felix:maven-bundle-plugin:2.5.4
[ERROR] strategy = org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy
[ERROR] urls[0] =
file:/usr/share/java/maven-plugin-bundle/maven-bundle-plugin.jar
[ERROR] urls[1] =
file:/usr/share/java/maven-reporting-impl/maven-reporting-impl.jar
[ERROR] urls[2] =
file:/usr/share/java/maven-reporting-api/maven-reporting-api.jar
[ERROR] urls[3] =
file:/usr/share/java/maven-shared-utils/maven-shared-utils.jar
[ERROR] urls[4] = file:/usr/share/java/commons-io.jar
[ERROR] urls[5] = file:/usr/share/java/jsr-305.jar
[ERROR] urls[6] = file:/usr/share/java/maven-doxia/doxia-core.jar
[ERROR] urls[7] = file:/usr/share/java/xerces-j2.jar
[ERROR] urls[8] = file:/usr/share/java/xml-commons-apis.jar
[ERROR] urls[9] = file:/usr/share/java/apache-commons-lang.jar
[ERROR] urls[10] = file:/usr/share/java/httpcomponents/httpclient.jar
[ERROR] urls[11] = file:/usr/share/java/commons-codec.jar
[ERROR] urls[12] = file:/usr/share/java/httpcomponents/httpcore.jar
[ERROR] urls[13] = file:/usr/share/java/xmlunit.jar
[ERROR] urls[14] = file:/usr/share/java/commons-validator.jar
[ERROR] urls[15] = file:/usr/share/java/apache-commons-beanutils.jar
[ERROR] urls[16] = file:/usr/share/java/commons-digester.jar
[ERROR] urls[17] = file:/usr/share/java/commons-logging.jar
[ERROR] urls[18] =
file:/usr/share/java/felix-framework/org.apache.felix.framework.jar
[ERROR] urls[19] = file:/usr/share/java/kxml.jar
[ERROR] urls[20] = file:/usr/share/java/xpp3.jar
[ERROR] urls[21] = file:/usr/share/java/maven/maven-builder-support.jar
[ERROR] urls[22] = file:/usr/share/java/guava.jar
[ERROR] urls[23] = file:/usr/share/java/plexus/interpolation.jar
[ERROR] urls[24] = file:/usr/share/java/org.eclipse.sisu.inject.jar
[ERROR] urls[25] =
file:/usr/share/java/plexus-containers/plexus-component-annotations.jar
[ERROR] urls[26] = file:/usr/share/java/felix/org.osgi.core.jar
[ERROR] urls[27] = file:/usr/share/java/aqute-bnd/biz.aQute.bndlib.jar
[ERROR] urls[28] =
file:/usr/lib64/eclipse/plugins/org.eclipse.osgi.services_3.5.0.v20160329-2000.jar
[ERROR] urls[29] =
file:/usr/lib64/eclipse/plugins/org.eclipse.osgi_3.10.102.v20160329-2000.jar
[ERROR] urls[30] = file:/usr/share/java/felix/felix-bundlerepository.jar
[ERROR] urls[31] = file:/usr/share/java/felix/org.apache.felix.utils.jar
[ERROR] urls[32] = file:/usr/share/java/felix/org.osgi.compendium.jar
[ERROR] urls[33] = file:/usr/share/java/glassfish-servlet-api.jar
[ERROR] urls[34] = file:/usr/share/java/felix/org.osgi.foundation.jar
[ERROR] urls[35] = file:/usr/share/java/aether/aether-util.jar
[ERROR] urls[36] = file:/usr/share/java/guice/google-guice-no_aop.jar
[ERROR] urls[37] = file:/usr/share/java/aopalliance.jar
[ERROR] urls[38] = file:/usr/share/java/plexus/plexus-sec-dispatcher.jar
[ERROR] urls[39] = file:/usr/share/java/plexus/plexus-cipher.jar
[ERROR] urls[40] = file:/usr/share/java/apache-commons-lang3.jar
[ERROR] urls[41] = file:/usr/share/java/maven-archiver/maven-archiver.jar
[ERROR] urls[42] = file:/usr/share/java/plexus/archiver.jar
[ERROR] urls[43] = file:/usr/share/java/plexus/io.jar
[ERROR] urls[44] = file:/usr/share/java/commons-compress.jar
[ERROR] urls[45] = file:/usr/lib/java/snappy-java/snappy-java.jar
[ERROR] urls[46] =
file:/usr/share/java/maven-dependency-tree/maven-dependency-tree.jar
[ERROR] urls[47] = file:/usr/share/java/plexus/utils.jar
[ERROR] urls[48] = file:/usr/share/java/plexus/plexus-build-api.jar
[ERROR] urls[49] = file:/usr/share/java/maven-doxia/doxia-sink-api.jar
[ERROR] urls[50] = file:/usr/share/java/maven-doxia/doxia-logging-api.jar
[ERROR] urls[51] =
file:/usr/share/java/maven-doxia-sitetools/doxia-site-renderer.jar
[ERROR] urls[52] =
file:/usr/share/java/maven-doxia-sitetools/doxia-decoration-model.jar
[ERROR] urls[53] = file:/usr/share/java/maven-doxia/doxia-module-xhtml.jar
[ERROR] urls[54] = file:/usr/share/java/maven-doxia/doxia-module-fml.jar
[ERROR] urls[55] = file:/usr/share/java/plexus-i18n/plexus-i18n.jar
[ERROR] urls[56] = file:/usr/share/java/objectweb-asm/asm-commons.jar
[ERROR] urls[57] = file:/usr/share/java/objectweb-asm/asm-tree.jar
[ERROR] urls[58] = file:/usr/share/java/objectweb-asm/asm.jar
[ERROR] urls[59] = file:/usr/share/java/xbean/xbean-reflect.jar
[ERROR] urls[60] = file:/usr/share/java/plexus-velocity/plexus-velocity.jar
[ERROR] urls[61] = file:/usr/share/java/velocity.jar
[ERROR] urls[62] = file:/usr/share/java/apache-commons-collections.jar
[ERROR] urls[63] = file:/usr/share/java/jdom.jar
[ERROR] Number of foreign imports: 1
[ERROR] import: Entry[import from realm ClassRealm[maven.api, parent: null]]
Expected results:
maven-bundle-plugin works as expected.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years
[Bug 1308619] New: CVE-2015-8795 solr: multiple XSS vulnerabilities
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1308619
Bug ID: 1308619
Summary: CVE-2015-8795 solr: multiple XSS vulnerabilities
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
CVE 2015-8795:
Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in
Apache Solr before 5.1 allow remote attackers to inject arbitrary web
script or HTML via crafted fields that are mishandled during the
rendering of the (1) Analysis page, related to
webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related
to webapp/web/js/scripts/schema-browser.js.
https://issues.apache.org/jira/browse/SOLR-7346
CVE 2015-8796:
Cross-site scripting (XSS) vulnerability in
webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr
before 5.3 allows remote attackers to inject arbitrary web script or
HTML via a crafted schema-browse URL.
https://issues.apache.org/jira/browse/SOLR-7920
CVE 2015-8797:
Cross-site scripting (XSS) vulnerability in
webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in
Apache Solr before 5.3.1 allows remote attackers to inject arbitrary
web script or HTML via the entry parameter to a plugins/cache URI.
https://issues.apache.org/jira/browse/SOLR-7949
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years
[Bug 1314239] New: powermock-1.6.4 is available
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1314239
Bug ID: 1314239
Summary: powermock-1.6.4 is available
Product: Fedora
Version: rawhide
Component: powermock
Assignee: rkennke(a)redhat.com
Reporter: puntogil(a)libero.it
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, msimacek(a)redhat.com,
neugens(a)redhat.com, projects.rg(a)smart.ms,
rkennke(a)redhat.com
Latest upstream release: 1.6.4
Current version/release in rawhide: 1.6.2-3.fc24
URL: https://github.com/jayway/powermock/tags
Please, consider upgrading
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years
[Bug 1320842] New: CVE-2016-2166 qpid-proton: reactor sends messages in clear if ssl is requested but not available
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1320842
Bug ID: 1320842
Summary: CVE-2016-2166 qpid-proton: reactor sends messages in
clear if ssl is requested but not available
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abaron(a)redhat.com, aortega(a)redhat.com,
apevec(a)redhat.com, ayoung(a)redhat.com,
bkearney(a)redhat.com, chrisw(a)redhat.com,
cpelland(a)redhat.com, dallan(a)redhat.com,
esammons(a)redhat.com, gkotton(a)redhat.com,
iboverma(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jross(a)redhat.com, jschluet(a)redhat.com,
kgiusti(a)gmail.com, kpalko(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, markmc(a)redhat.com,
mcressma(a)redhat.com, messaging-bugs(a)redhat.com,
mmccune(a)redhat.com, ohadlevy(a)redhat.com,
pmyers(a)redhat.com, puntogil(a)libero.it,
rbryant(a)redhat.com, rhos-maint(a)redhat.com,
rrajasek(a)redhat.com, satellite6-bugs(a)redhat.com,
sclewis(a)redhat.com, tdecacqu(a)redhat.com,
tjay(a)redhat.com, tlestach(a)redhat.com
Messaging applications using the Proton Python API to provision an SSL/TLS
encrypted TCP connection may actually instantiate a non-encrypted connection
without notice if SSL support is unavailable. This will result in all messages
being sent in the clear without the knowledge of the user.
This issue affects those applications that use the Proton Reactor Python API to
create SSL/TLS connections. Specifically the proton.reactor.Connector,
proton.reactor.Container, and proton.utils.BlockingConnection classes are
vulnerable. These classes can create an unencrypted connections if the
"amqps://" URL prefix is used.
The issue only occurs if the installed Proton libraries do not support SSL.
This would be the case if the libraries were built without SSL support or the
necessary SSL libraries are not present on the system (e.g. OpenSSL in the case
of *nix).
References:
http://seclists.org/bugtraq/2016/Mar/166
Upstream fix:
https://issues.apache.org/jira/browse/PROTON-1157
Upstream fixed release:
http://qpid.apache.org/releases/qpid-proton-0.12.1/
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years
[Bug 1326403] New: CVE-2016-3102 jenkins: Groovy sandbox protection incomplete in Script Security Plugin (SECURITY-258)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1326403
Bug ID: 1326403
Summary: CVE-2016-3102 jenkins: Groovy sandbox protection
incomplete in Script Security Plugin (SECURITY-258)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The Script Security plugin provides a Groovy sandbox implementation to other
plugins that only allows whitelisted commands to be executed. This sandbox did
not cover direct field access (foo.@bar) or get/set array operations
(foo[bar]).
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month
[Bug 1326402] New: CVE-2016-3101 jenkins: Stored XSS vulnerability in Extra Columns Plugin (SECURITY-136)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1326402
Bug ID: 1326402
Summary: CVE-2016-3101 jenkins: Stored XSS vulnerability in
Extra Columns Plugin (SECURITY-136)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The Extra Columns plugin rendered user-supplied HTML in tool tips without
filtering them through the configured markup formatter.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 1 month