[Bug 1413466] CVE-2016-6814 Apache Groovy: Information disclosure
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1413466
Pavel Polischouk <pavelp(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Doc Type|If docs needed, set a value |Bug Fix
--- Doc Text *updated* ---
It was found that a flaw in apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 3 months
[Bug 1363887] New: The tomcat-tool-wrapper script is broken
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1363887
Bug ID: 1363887
Summary: The tomcat-tool-wrapper script is broken
Product: Red Hat Enterprise Linux 7
Version: 7.2
Component: tomcat
Assignee: csutherl(a)redhat.com
Reporter: csutherl(a)redhat.com
QA Contact: tomcat-qe(a)redhat.com
CC: alee(a)redhat.com, csutherl(a)redhat.com,
extras-qa(a)fedoraproject.org, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net,
trick(a)vanstaveren.us
Depends On: 1363884
+++ This bug was initially created as a clone of Bug #1363884 +++
Description of problem:
The tomcat-tool-wrapper provided by the tomcat package doesn't work.
Version-Release number of selected component (if applicable):
tomcat-8.0.32-5.fc23.noarch
How reproducible:
Every time.
Steps to Reproduce:
1. Install tomcat via `yum install tomcat`
2. Execute the command and observe:
[coty@localhost tomcat]$ tomcat-tool-wrapper -server
org.apache.catalina.realm.RealmBase -a md5 test
Exception in thread "main" java.lang.NoClassDefFoundError:
org/apache/tomcat/util/ExceptionUtils
at org.apache.catalina.startup.Tool.main(Tool.java:218)
Caused by: java.lang.ClassNotFoundException:
org.apache.tomcat.util.ExceptionUtils
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 1 more
ABRT problem creation: 'success'
Actual results:
A CNFE is thrown because the ExceptionUtils class is not in the classpath.
Expected results:
[coty@localhost tomcat]$ tomcat-tool-wrapper -server
org.apache.catalina.realm.RealmBase -a md5 test
test:4af3bd7759edac2bd372d04c343aee12f789394ecada8c9ce6fc32555fbf5c76$1$58040d6efb505a5e2bcf7c863968a192
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1363884
[Bug 1363884] The tomcat-tool-wrapper script is broken
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 3 months
[Bug 1340396] CVE-2016-2175 pdfbox: XML External Entity vulnerability
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1340396
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
|0527,reported=20160527,sour |0527,reported=20160527,sour
|ce=oss-security,cvss2=5.8/A |ce=oss-security,cvss2=5.8/A
|V:N/AC:M/Au:N/C:P/I:N/A:P,c |V:N/AC:M/Au:N/C:P/I:N/A:P,c
|vss3=5.4/CVSS:3.0/AV:N/AC:L |vss3=5.4/CVSS:3.0/AV:N/AC:L
|/PR:N/UI:R/S:U/C:L/I:N/A:L, |/PR:N/UI:R/S:U/C:L/I:N/A:L,
|cwe=CWE-611,fedora-all/pdfb |cwe=CWE-611,fedora-all/pdfb
|ox=affected,bpms-6/pdfbox=a |ox=affected,bpms-6/pdfbox=a
|ffected/cvss2=3.3/AV:L/AC:M |ffected/cvss2=3.3/AV:L/AC:M
|/Au:N/C:P/I:N/A:P/cvss3=4.4 |/Au:N/C:P/I:N/A:P/cvss3=4.4
|/CVSS:3.0/AV:L/AC:L/PR:N/UI |/CVSS:3.0/AV:L/AC:L/PR:N/UI
|:R/S:U/C:L/I:N/A:L,brms-6/p |:R/S:U/C:L/I:N/A:L,brms-6/p
|dfbox=affected/cvss2=3.3/AV |dfbox=affected/cvss2=3.3/AV
|:L/AC:M/Au:N/C:P/I:N/A:P/cv |:L/AC:M/Au:N/C:P/I:N/A:P/cv
|ss3=4.4/CVSS:3.0/AV:L/AC:L/ |ss3=4.4/CVSS:3.0/AV:L/AC:L/
|PR:N/UI:R/S:U/C:L/I:N/A:L,j |PR:N/UI:R/S:U/C:L/I:N/A:L,j
|dv-6/pdfbox=affected,jdv-7/ |dv-6/pdfbox=affected,fuse-6
|pdfbox=affected,fuse-6/pdfb |/pdfbox=affected,fsw-6/pdfb
|ox=affected,fsw-6/pdfbox=no |ox=notaffected,jpp-6/pdfbox
|taffected,jpp-6/pdfbox=wont |=wontfix,rhn_satellite_5/pd
|fix,rhn_satellite_5/pdfbox= |fbox=affected
|affected |
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 3 months
[Bug 1367447] CVE-2016-6325 tomcat: tomcat writable config files allow privilege escalation
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1367447
Timothy Walsh <twalsh(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |alee(a)redhat.com,
| |gzaronik(a)redhat.com,
| |ivan.afonichev(a)gmail.com,
| |java-sig-commits(a)lists.fedo
| |raproject.org,
| |krzysztof.daniel(a)gmail.com,
| |me(a)coolsvap.net,
| |trick(a)vanstaveren.us
Whiteboard|impact=important,public=201 |impact=important,public=201
|61010,reported=20160809,sou |61010,reported=20160809,sou
|rce=redhat,cvss2=6.9/AV:L/A |rce=redhat,cvss2=6.9/AV:L/A
|C:M/Au:N/C:C/I:C/A:C,cvss3= |C:M/Au:N/C:C/I:C/A:C,cvss3=
|7.8/CVSS:3.0/AV:L/AC:L/PR:L |7.8/CVSS:3.0/AV:L/AC:L/PR:L
|/UI:N/S:U/C:H/I:H/A:H,cwe=C |/UI:N/S:U/C:H/I:H/A:H,cwe=C
|WE-284,rhel-5/tomcat5=affec |WE-284,rhel-5/tomcat5=affec
|ted,rhel-6/tomcat6=affected |ted,rhel-6/tomcat6=affected
|,rhel-7/tomcat=affected/imp |,rhel-7/tomcat=affected/cvs
|act=low/cvss2=1.9/AV:L/AC:M |s3=3.3/CVSS:3.0/AV:L/AC:L/P
|/Au:N/C:N/I:P/A:N/cvss3=3.3 |R:L/UI:N/S:U/C:N/I:L/A:N/cv
|/CVSS:3.0/AV:L/AC:L/PR:L/UI |ss2=1.9/AV:L/AC:M/Au:N/C:N/
|:N/S:U/C:N/I:L/A:N,fedora-a |I:P/A:N/impact=low,fedora-a
|ll/tomcat=affected,epel-6/t |ll/tomcat=affected,epel-6/t
|omcat=affected,jbews-2/tomc |omcat=affected,jbews-2/tomc
|at=affected,jbews-3/tomcat= |at=wontfix,jbews-3/tomcat=d
|affected |efer,jws-3/tomcat7=affected
| |,jws-3/tomcat8=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 3 months