[Bug 1454808] New: CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four letter words
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1454808
Bug ID: 1454808
Summary: CVE-2017-5637 zookeeper: Incorrect input validation
with wchp/wchc four letter words
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, chazlett(a)redhat.com,
ctubbsii(a)fedoraproject.org, ethan(a)ethantuttle.com,
etirelli(a)redhat.com, felias(a)redhat.com,
hchiorea(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jolee(a)redhat.com,
kseifried(a)redhat.com, kverlaen(a)redhat.com,
lpetrovi(a)redhat.com, mbaluch(a)redhat.com,
mluscon(a)gmail.com, mwinkler(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
rrajasek(a)redhat.com, rzhang(a)redhat.com, s(a)shk.io,
tiwillia(a)redhat.com, tkirby(a)redhat.com,
tstclair(a)heptio.com, vhalbert(a)redhat.com
Two four letter word commands “wchp/wchc” are CPU intensive and could cause
spike of CPU utilization on ZooKeeper server if abused, which leads to the
server unable to serve legitimate client requests.
Upstream issue:
https://issues.apache.org/jira/browse/ZOOKEEPER-2693
References:
https://vulners.com/exploitdb/EDB-ID:41277
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 3 months
[Bug 1441223] New: CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1441223
Bug ID: 1441223
Summary: CVE-2017-5648 tomcat: Calls to application listeners
did not use the appropriate facade object
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: alee(a)redhat.com, bbaranow(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
felias(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, hhorak(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, joelsmith(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jshepherd(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net,
mizdebsk(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, psotirop(a)redhat.com,
rnetuka(a)redhat.com, rsvoboda(a)redhat.com,
spinder(a)redhat.com, theute(a)redhat.com,
trick(a)vanstaveren.us, twalsh(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com,
weli(a)redhat.com
While investigating bug 60718, it was noticed that some calls to application
listeners did not use the appropriate facade object. When running an untrusted
application under a SecurityManager, it was therefore possible for that
untrusted application to retain a reference to the request or response object
and thereby access and/or modify information associated with another web
application.
Upstream fixes:
Tomcat 7.x:
https://svn.apache.org/viewvc?view=revision&revision=1785777
Tomcat 8.0.x:
https://svn.apache.org/viewvc?view=revision&revision=1785776
Tomcat 8.5.x:
https://svn.apache.org/viewvc?view=revision&revision=1785775
References:
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.76
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.42
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.12
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 3 months
[Bug 1441205] New: CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1441205
Bug ID: 1441205
Summary: CVE-2017-5647 tomcat: Incorrect handling of pipelined
requests when send file was used
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, bbaranow(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
etirelli(a)redhat.com, felias(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, hhorak(a)redhat.com,
huwang(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, joelsmith(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jshepherd(a)redhat.com, kconner(a)redhat.com,
krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lpetrovi(a)redhat.com, mbabacek(a)redhat.com,
mbaluch(a)redhat.com, me(a)coolsvap.net,
mizdebsk(a)redhat.com, mwinkler(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
psotirop(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
trick(a)vanstaveren.us, twalsh(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com,
weli(a)redhat.com
A bug in the handling of the pipelined requests when send file was used
resulted in the pipelined request being lost when send file processing of the
previous request completed. This could result in responses appearing to be sent
for the wrong request. For example, a user agent that sent requests A, B and C
could see the correct response for request A, the response for request C for
request B and no response for request C.
Affected versions: 6.0.0 to 6.0.52, 7.0.0 to 7.0.76, 8.0.0.RC1 to 8.0.42
Fixed in revisions:
Tomcat 6:
https://svn.apache.org/viewvc?view=revision&revision=1789024
https://svn.apache.org/viewvc?view=revision&revision=1789155
https://svn.apache.org/viewvc?view=revision&revision=1789856
Tomcat 7:
https://svn.apache.org/viewvc?view=revision&revision=1789008
Tomcat 8:
https://svn.apache.org/viewvc?view=revision&revision=1788999
References:
https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.53
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.77
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.43
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 3 months
[Bug 1397484] New: CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1397484
Bug ID: 1397484
Summary: CVE-2016-6816 tomcat: HTTP Request smuggling
vulnerability due to permitting invalid character in
HTTP requests
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aileenc(a)redhat.com, alee(a)redhat.com,
aszczucz(a)redhat.com, bbaranow(a)redhat.com,
bdawidow(a)redhat.com, bgollahe(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
epp-bugs(a)redhat.com, felias(a)redhat.com,
fnasser(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, hfnukal(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
jason.greene(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jshepherd(a)redhat.com,
kanderso(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, lmeyer(a)redhat.com,
mbabacek(a)redhat.com, mbaluch(a)redhat.com,
me(a)coolsvap.net, miburman(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
mnewsome(a)redhat.com, mweiler(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
ohudlick(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rsvoboda(a)redhat.com, rzima(a)redhat.com,
spinder(a)redhat.com, theute(a)redhat.com,
trick(a)vanstaveren.us, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
The code that parsed the HTTP request line permitted invalid characters. This
could be exploited, in conjunction with a proxy that also permitted the invalid
characters but with a different interpretation, to inject data into the HTTP
response. By manipulating the HTTP response the attacker could poison a
web-cache, perform an XSS attack and/or obtain sensitive information from
requests other then their own.
Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6
Upstream patches:
Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767683
Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767675
Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767653
Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767645
External References:
https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 3 months
[Bug 1376712] New: CVE-2016-1240 tomcat: Local privilege escalation via unsafe file handling in the Tomcat init script
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1376712
Bug ID: 1376712
Summary: CVE-2016-1240 tomcat: Local privilege escalation via
unsafe file handling in the Tomcat init script
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: alee(a)redhat.com, aszczucz(a)redhat.com,
bbaranow(a)redhat.com, bdawidow(a)redhat.com,
bgollahe(a)redhat.com, bmaxwell(a)redhat.com,
ccoleman(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
dosoudil(a)redhat.com, epp-bugs(a)redhat.com,
felias(a)redhat.com, fnasser(a)redhat.com,
hchiorea(a)redhat.com, hfnukal(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
jason.greene(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jshepherd(a)redhat.com,
kanderso(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, lmeyer(a)redhat.com,
mbabacek(a)redhat.com, mbaluch(a)redhat.com,
me(a)coolsvap.net, miburman(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
mnewsome(a)redhat.com, mweiler(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
ohudlick(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rsvoboda(a)redhat.com, rzima(a)redhat.com,
spinder(a)redhat.com, theute(a)redhat.com,
trick(a)vanstaveren.us, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
It was reported that the Tomcat init script performed unsafe file handling,
which could result in local privilege escalation.
References:
http://seclists.org/bugtraq/2016/Sep/26
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 3 months
[Bug 1516791] New: CVE-2017-1000392 jenkins: Persisted XSS vulnerability in autocompletion suggestions
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1516791
Bug ID: 1516791
Summary: CVE-2017-1000392 jenkins: Persisted XSS vulnerability
in autocompletion suggestions
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Autocompletion suggestions for text fields were not escaped, resulting in a
persisted cross-site scripting vulnerability if the source for the suggestions
allowed specifying text that includes HTML metacharacters like less-than and
greater-than characters.
Known previously unsafe sources for these suggestions include the names of
loggers in the log recorder condition, and agent labels.
External References:
https://jenkins.io/security/advisory/2017-11-08/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 4 months
[Bug 1516788] New: CVE-2017-1000391 jenkins: Unsafe use of user names as directory names
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1516788
Bug ID: 1516788
Summary: CVE-2017-1000391 jenkins: Unsafe use of user names as
directory names
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Jenkins stores metadata related to people, which encompasses actual user
accounts, as well as users appearing in SCM, in directories corresponding to
the user ID on disk. These directories used the user ID for their name without
additional escaping. This potentially resulted in a number of problems, such as
the following:
1. User names consisting of a single forward slash would have their user record
stored in the parent directory; deleting this user deleted all user records.
2. User names containing character sequences such as .. could be used to
clobber other configuration files in Jenkins.
This is not limited to the Jenkins user database security realm, other security
realms such as LDAP may allow users to create user names that result in
problems in Jenkins.
External References:
https://jenkins.io/security/advisory/2017-11-08/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 4 months
[Bug 1469356] New: aether-ant-tasks: Port to XMvn 3.0.0
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1469356
Bug ID: 1469356
Summary: aether-ant-tasks: Port to XMvn 3.0.0
Product: Fedora
Version: rawhide
Component: aether-ant-tasks
Assignee: mizdebsk(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
aether-ant-tasks needs porting to XMvn 3.0.0 (or retiring).
aether-ant-tasks has broken dependencies in the rawhide tree:
aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 4 months