[Bug 1375884] New: CVE-2016-6802 Apache Shiro: Security servlet filters bypass
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1375884
Bug ID: 1375884
Summary: CVE-2016-6802 Apache Shiro: Security servlet filters
bypass
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
chazlett(a)redhat.com, dmcphers(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jialiu(a)redhat.com,
jokerman(a)redhat.com, kconner(a)redhat.com,
kseifried(a)redhat.com, ldimaggi(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
puntogil(a)libero.it, rwagner(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
tcunning(a)redhat.com, tiwillia(a)redhat.com,
tkirby(a)redhat.com
Apache Shiro before 1.3.2, when using a non-root servlet context path,
specifically crafted requests can be used to by pass some security servlet
filters, resulting in unauthorized access.
References:
http://seclists.org/oss-sec/2016/q3/488
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 7 months
[Bug 1257246] New: CVE-2015-6524 activemq: LDAPLoginModule implementation allows wildcard operators in usernames
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1257246
Bug ID: 1257246
Summary: CVE-2015-6524 activemq: LDAPLoginModule implementation
allows wildcard operators in usernames
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: agrimm(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com, s(a)shk.io,
tdawson(a)redhat.com, weli(a)redhat.com
Common Vulnerabilities and Exposures assigned an identifier CVE-2015-6524 to
the following vulnerability:
The LDAPLoginModule implementation the Java Authentication and Authorization
Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators
in usernames, which allows remote attackers to obtain credentials via a brute
force attack.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=kJ763Ve2az&a=cc_unsubscribe
_______________________________________________
java-sig-commits mailing list
java-sig-commits(a)lists.fedoraproject.org
http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedorapro...
7 years, 7 months
[Bug 1353999] New: CNFE when running thermostat web-storage-service with jetty 9.4.0.M0
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1353999
Bug ID: 1353999
Summary: CNFE when running thermostat web-storage-service with
jetty 9.4.0.M0
Product: Fedora
Version: rawhide
Component: jetty
Assignee: mizdebsk(a)redhat.com
Reporter: sgehwolf(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com
Created attachment 1177703
--> https://bugzilla.redhat.com/attachment.cgi?id=1177703&action=edit
Proposed fix which works for us.
Description of problem:
This is an upstream bug in upcoming jetty 9.4.0. Caused by this refactoring:
https://github.com/eclipse/jetty.project/commit/a311c8bde171551a57ff28c04...
Version-Release number of selected component (if applicable):
$ rpm -q jetty-server
jetty-server-9.4.0-0.2.M0.fc25.noarch
$ rpm -q thermostat
thermostat-1.6.0-1.fc25.x86_64
How reproducible:
100%
Steps to Reproduce:
1. dnf install thermostat-webapp (A mock setup will do too)
2. echo -e 'yes\nm\nm\nm\nc\nc\nc\na\na\na' | thermostat setup -c
3. thermostat web-storage-service
Actual results:
starting storage server...
server listening on ip: mongodb://127.0.0.1:27518
log file is here: /root/.thermostat-1.6/logs/db.log
pid: 8285
2016-07-08 15:01:52.035:INFO::Thread-3: Logging initialized @1374ms
2016-07-08 15:01:52.083:INFO:oejs.Server:Thread-3: jetty-9.4.0.M0
2016-07-08 15:01:52.083:WARN:oejs.Server:Thread-3: THIS IS NOT A STABLE
RELEASE! DO NOT USE IN PRODUCTION!
2016-07-08 15:01:52.083:WARN:oejs.Server:Thread-3: Download a stable release
from http://download.eclipse.org/jetty/
2016-07-08 15:01:52.092:WARN:oejw.WebAppContext:Thread-3: Failed startup of
context
o.e.j.w.WebAppContext@6cdce5ed{/thermostat/storage,null,null}{/usr/share/thermostat/webapp}
java.lang.ClassNotFoundException: org.eclipse.jetty.webapp.WebInfConfiguration
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at org.eclipse.jetty.util.Loader.loadClass(Loader.java:65)
at
org.eclipse.jetty.webapp.WebAppContext.loadConfigurations(WebAppContext.java:931)
at
org.eclipse.jetty.webapp.WebAppContext.preConfigure(WebAppContext.java:451)
at
org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:520)
at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at
org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)
at org.eclipse.jetty.server.Server.start(Server.java:437)
at
org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:106)
at
org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:93)
at org.eclipse.jetty.server.Server.doStart(Server.java:404)
at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at
com.redhat.thermostat.web.endpoint.internal.JettyContainerLauncher.doStartContainerAndDeployWar(JettyContainerLauncher.java:214)
at
com.redhat.thermostat.web.endpoint.internal.JettyContainerLauncher.startContainerAndDeployWar(JettyContainerLauncher.java:125)
at
com.redhat.thermostat.web.endpoint.internal.JettyContainerLauncher.access$000(JettyContainerLauncher.java:77)
at
com.redhat.thermostat.web.endpoint.internal.JettyContainerLauncher$1.run(JettyContainerLauncher.java:99)
at java.lang.Thread.run(Thread.java:745)
server shutdown complete: /root/.thermostat-1.6/data/db
log file is here: /root/.thermostat-1.6/logs/db.log
Failed to start embedded jetty instance
Expected results:
No ClassNotFoundException and successful startup.
Additional info:
This is likely only reproducible when jetty is being started within an OSGi
environment. Such is the case for "thermostat web-storage-service".
Note that the code in Loader around line 65 looks like this:
@SuppressWarnings("rawtypes")
public static Class loadClass(String name)
throws ClassNotFoundException
{
ClassLoader loader=Thread.currentThread().getContextClassLoader();
return (loader==null ) ? Class.forName(name) : loader.loadClass(name);
}
loader in this context points to the app class loader which booted up the OSGi
framework. However, the OSGi bundle jetty-webapp was loaded as a bundle and
thus, classes inside it will get loaded with the bundles class loader. Then
TCCL won't see the relevant config classes in the webapp bundle whereas the
bundle class loader would see it.
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1380434] New: machine does not come back from hibernation
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1380434
Bug ID: 1380434
Summary: machine does not come back from hibernation
Product: Fedora
Version: 24
Component: hibernate
Severity: medium
Assignee: puntogil(a)libero.it
Reporter: rayholme(a)yahoo.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Description of problem:After hibernating the box and power resumed, I cannot
login and the screen is dead.
Version-Release number of selected component (if applicable): Fedora 24
How reproducible: Happens every third or fourth time I hibernate box.
Steps to Reproduce:
1. login to cinnamon screens, play ...
2. use power button to force hibernation
3. use power button to come back
Actual results: Every 3rd or 4th time, screen comes back with clock showing
same time as when I shutdown, NO password screen shows, and I cannot get one by
pressing any keys.
Expected results: Should get password screen and be able to re-new where I was.
Additional info: Machine has 4 cpus and a graphics processor. Have not noticed
this problem on another machine which has 2 cpus and no graphics processor BUT
is used MUCH less.
I believe I could login from the other machine using ssh, so if there is
anything I can do to capture what is going on for documentation, please let me
know. Currently the work around is to unplug and replug in the machine forcing
a reboot. If this is the wrong component, please tell me how to find the right
one for future reports.
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1375363] New: checkstyle fails due to missing org/apache/commons/ lang3/ArrayUtils
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1375363
Bug ID: 1375363
Summary: checkstyle fails due to missing
org/apache/commons/lang3/ArrayUtils
Product: Fedora
Version: 24
Component: checkstyle
Severity: high
Assignee: mizdebsk(a)redhat.com
Reporter: jayvdb(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
Description of problem:
checkstyle does not execute.
Version-Release number of selected component (if applicable): 6.13-2.fc24
How reproducible:
Very
Steps to Reproduce:
1. Create a sample settings XML (sample at
http://www.javaworld.com/article/2077945/open-source-tools/automated-code...)
2. Run tool on some java code: checkstyle -c settings.xml src
Actual results:
Exception in thread "main" java.lang.NoClassDefFoundError:
org/apache/commons/lang3/ArrayUtils
at com.puppycrawl.tools.checkstyle.Checker.<init>(Checker.java:98)
at com.puppycrawl.tools.checkstyle.Main.runCheckstyle(Main.java:266)
at com.puppycrawl.tools.checkstyle.Main.main(Main.java:119)
Caused by: java.lang.ClassNotFoundException:
org.apache.commons.lang3.ArrayUtils
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 3 more
Expected results:
The checker runs
Additional info:
The only seemingly relevant package apache-commons-lang3 is already installed.
$ dnf search lang3
Last metadata expiration check: 2 days, 1:34:28 ago on Sun Sep 11 02:15:33
2016.
================================================================= N/S Matched:
lang3 =================================================================
apache-commons-lang3-javadoc.noarch : API documentation for
apache-commons-lang3
apache-commons-lang3.noarch : Provides a host of helper utilities for the
java.lang API
$ sudo dnf install apache-commons-lang3
Last metadata expiration check: 2:13:07 ago on Tue Sep 13 01:37:09 2016.
Package apache-commons-lang3-3.4-4.fc24.noarch is already installed, skipping.
Dependencies resolved.
Nothing to do.
Complete!
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months
[Bug 1371730] New: jsch-0.1.54 is available
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1371730
Bug ID: 1371730
Summary: jsch-0.1.54 is available
Product: Fedora
Version: rawhide
Component: jsch
Keywords: FutureFeature, Triaged
Assignee: akurtako(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com,
mizdebsk(a)redhat.com
Latest upstream release: 0.1.54
Current version/release in rawhide: 0.1.53-5.fc25
URL: http://www.jcraft.com/jsch/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1475/
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 8 months