[Bug 1347835] New: The security manager doesn't work correctly ( JSPs cannot be compiled)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1347835
Bug ID: 1347835
Summary: The security manager doesn't work correctly (JSPs
cannot be compiled)
Product: Fedora
Version: 23
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: csutherl(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net,
tomcat-qe(a)redhat.com, trick(a)vanstaveren.us
Depends On: 1347774, 927930
Blocks: 1347142, 1347144, 1347146, 1347778
+++ This bug was initially created as a clone of Bug #1347774 +++
Description of problem:
When using the security manager for the tomcat service, JSPs are inaccessible
(they won't compile) because of access permissions.
+++
HTTP Status 500 - access denied ("java.lang.RuntimePermission"
"accessClassInPackage.org.apache.jasper")
type Exception report
message access denied ("java.lang.RuntimePermission"
"accessClassInPackage.org.apache.jasper")
description The server encountered an internal error that prevented it from
fulfilling this request.
exception
java.security.AccessControlException: access denied
("java.lang.RuntimePermission" "accessClassInPackage.org.apache.jasper")
java.security.AccessControlContext.checkPermission(AccessControlContext.java:474)
java.security.AccessController.checkPermission(AccessController.java:685)
java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
java.lang.SecurityManager.checkPackageAccess(SecurityManager.java:1525)
sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:305)
java.lang.ClassLoader.loadClass(ClassLoader.java:412)
java.lang.ClassLoader.loadClass(ClassLoader.java:358)
org.apache.jasper.servlet.JspServletWrapper.<init>(JspServletWrapper.java:120)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:382)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:334)
javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277)
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274)
java.security.AccessController.doPrivileged(Native Method)
javax.security.auth.Subject.doAsPrivileged(Subject.java:536)
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309)
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:169)
java.security.AccessController.doPrivileged(Native Method)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
java.lang.reflect.Method.invoke(Method.java:606)
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:277)
org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:274)
java.security.AccessController.doPrivileged(Native Method)
javax.security.auth.Subject.doAsPrivileged(Subject.java:536)
org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:309)
org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:249)
+++
Version-Release number of selected component (if applicable):
tomcat-8.0.32-5.fc23.noarch
How reproducible:
Every time :(
Steps to Reproduce:
1. yum install tomcat
2. echo "SECURITY_MANAGER=\"true\"" >> /etc/sysconfig/tomcat
3. cp reproducer.tar /usr/share/tomcat/webapps/
4. service tomcat start
5. curl -is http://localhost:8080/reproducer/
Actual results:
JSP compilation fails and an error is observed
Expected results:
JSP compiles and displays correctly.
Additional info:
It looks like the java policy in use (catalina.policy) doesn't allow for use of
jars from /usr/share/java
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=927930
[Bug 927930] java.security.AccessControlException: access denied on tomcat6
rpm running with security manager
https://bugzilla.redhat.com/show_bug.cgi?id=1347774
[Bug 1347774] The security manager doesn't work correctly (JSPs cannot be
compiled)
https://bugzilla.redhat.com/show_bug.cgi?id=1347778
[Bug 1347778] The security manager doesn't work correctly
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 6 months
[Bug 1293636] New: Systemd tomcat.service unit loads
/etc/sysconfig/tomcat without shell expansion
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1293636
Bug ID: 1293636
Summary: Systemd tomcat.service unit loads
/etc/sysconfig/tomcat without shell expansion
Product: Fedora
Version: 23
Component: tomcat
Severity: medium
Priority: medium
Assignee: ivan.afonichev(a)gmail.com
Reporter: csutherl(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, ant(a)symons.net.au,
csutherl(a)redhat.com, gnaik(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, lcosti(a)redhat.com,
martijn(a)xbsd.nl, mbabacek(a)redhat.com, me(a)coolsvap.net,
mpicoto(a)redhat.com, rbost(a)redhat.com,
redhat.mx(a)jules.de, william(a)firstyear.id.au
Depends On: 1221896
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1221896
[Bug 1221896] Tomcat 7.0.42-8 tomcat.service loads /etc/sysconfig/tomcat
without shell expansion
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=8ZuZPmnprX&a=cc_unsubscribe
7 years, 6 months
[Bug 1257246] New: CVE-2015-6524 activemq: LDAPLoginModule implementation allows wildcard operators in usernames
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
Bug ID: 1257246
Summary: CVE-2015-6524 activemq: LDAPLoginModule implementation
allows wildcard operators in usernames
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: agrimm(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com, s(a)shk.io,
tdawson(a)redhat.com, weli(a)redhat.com
Common Vulnerabilities and Exposures assigned an identifier CVE-2015-6524 to
the following vulnerability:
The LDAPLoginModule implementation the Java Authentication and Authorization
Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators
in usernames, which allows remote attackers to obtain credentials via a brute
force attack.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=kJ763Ve2az&a=cc_unsubscribe
_______________________________________________
java-sig-commits mailing list
java-sig-commits(a)lists.fedoraproject.org
http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedorapro...
7 years, 7 months
[Bug 1349478] New: jackson-{core,databind,...}: Please update to new upstream versions
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1349478
Bug ID: 1349478
Summary: jackson-{core,databind,...}: Please update to new
upstream versions
Product: Fedora
Version: rawhide
Component: jackson-core
Assignee: puntogil(a)libero.it
Reporter: msimacek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Description of problem:
jackson-core, jackson-databind and other jackson-* projects have new upstream
versions available. Please consider updating.
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 7 months
[Bug 1342219] New: tomcat doesn't apply catalina.policy for webapps
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1342219
Bug ID: 1342219
Summary: tomcat doesn't apply catalina.policy for webapps
Product: Fedora
Version: 23
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: mad.kanie(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
Description of problem:
tomcat doesn't respect some custom policies for webapps declared by 'codeBase'.
Version-Release number of selected component (if applicable):
8.0.32
How reproducible:
always, security manager enabled. grant with no codeBase specified works fine.
Steps to Reproduce:
1. deploy the example war file attached (catalina_policy_test.war);
2. browse 'http://localhost:8080/catalina_policy_test/index.html' (change the
port if needed);
3. an AccessControlException is raised.
Actual results:
An AccessControlException is raised for "java.util.PropertyPermission"
"user.home" action "read".
Expected results:
The user.home property should be printed.
Additional info:
vanilla package from tomcat.apache.org (8.0.35) doesn't have this problem.
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 7 months