[Bug 1504458] New: takari-lifecycle-1.13.3 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1504458
Bug ID: 1504458
Summary: takari-lifecycle-1.13.3 is available
Product: Fedora
Version: rawhide
Component: takari-lifecycle
Keywords: FutureFeature, Triaged
Assignee: mizdebsk(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dchen(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
Latest upstream release: 1.13.3
Current version/release in rawhide: 1.13.2-1.fc28
URL: http://takari.io
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/9577/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 6 months
[Bug 1516988] New: CVE-2017-5533 jasperreports: Information disclosure in content cache
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1516988
Bug ID: 1516988
Summary: CVE-2017-5533 jasperreports: Information disclosure in
content cache
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
A vulnerability in the server content cache of TIBCO JasperReports Server,
TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for
ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO
Jaspersoft Reporting and Analytics for AWS contains a vulnerability which fails
to prevent remote access to all the contents of the web application, including
key configuration files. Affected releases are TIBCO JasperReports Server
6.4.0, TIBCO JasperReports Server Community Edition 6.4.0, TIBCO JasperReports
Server for ActiveMatrix BPM 6.4.0, TIBCO Jaspersoft for AWS with Multi-Tenancy
6.4.0, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0.
External References:
https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 6 months
[Bug 1516987] New: CVE-2017-5532 jasperreports: XSS leading to privilege escalation
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1516987
Bug ID: 1516987
Summary: CVE-2017-5532 jasperreports: XSS leading to privilege
escalation
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
A vulnerability in the report renderer component of TIBCO JasperReports Server,
TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for
ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library for
ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft
Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, and TIBCO Jaspersoft
Studio for ActiveMatrix BPM may allow a subset of authorized users to perform
persistent cross-site scripting (XSS) attacks. Affected releases are TIBCO
JasperReports Server 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, TIBCO
JasperReports Server Community Edition 6.4.0 and below, TIBCO JasperReports
Server for ActiveMatrix BPM 6.4.0 and below, TIBCO JasperReports Library 6.2.3
and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0; 6.4.1, TIBCO JasperReports Library for
ActiveMatrix BPM 6.4.1 and below, TIBCO Jaspersoft for AWS with Multi-Tenancy
6.4.0 and below, TIBCO Jaspersoft Reporting and Analytics for AWS 6.4.0 and
below, TIBCO Jaspersoft Studio 6.2.3 and below; 6.3.0; 6.3.1; 6.3.2; 6.4.0, and
TIBCO Jaspersoft Studio for ActiveMatrix BPM 6.4.0 and below.
External references:
https://www.tibco.com/support/advisories/2017/11/tibco-security-advisory-...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 6 months
[Bug 1515068] jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490) [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1515068
--- Comment #1 from Mark Knowles <mknowles(a)redhat.com> ---
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
=====
# bugfix, security, enhancement, newpackage (required)
type=security
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1501813,1515068
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
suggest_reboot=False
======
Additionally, you may opt to use the bodhi web interface to submit updates:
https://bodhi.fedoraproject.org/updates/new
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 6 months
[Bug 1506612] CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-7525)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1506612
Doran Moppert <dmoppert(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71102,reported=20171009,sou |71102,reported=20171009,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,cwe=CWE-184 |S:U/C:H/I:H/A:H,cwe=CWE-184
|,fedora-all/jackson-databin |,fedora-all/jackson-databin
|d=affected,amq-6/jackson-da |d=affected,amq-6/jackson-da
|tabind=notaffected,jdg-7/ja |tabind=notaffected,jdg-7/ja
|ckson-databind=notaffected, |ckson-databind=notaffected,
|jdv-6/jackson-databind=nota |jdv-6/jackson-databind=nota
|ffected,eap-7/jackson-datab |ffected,eap-7/jackson-datab
|ind=affected,bpms-6/jackson |ind=affected,bpms-6/jackson
|-databind=notaffected,brms- |-databind=notaffected,brms-
|6/jackson-databind=notaffec |6/jackson-databind=notaffec
|ted,fuse-6/jackson-databind |ted,fuse-6/jackson-databind
|=notaffected,openshift-ente |=notaffected,openshift-ente
|rprise-2/jackson-databind=n |rprise-2/jackson-databind=n
|otaffected,rhn_satellite_6/ |otaffected,rhn_satellite_6/
|jackson-databind=affected,r |jackson-databind=affected,r
|hmap-4/jackson-databind=not |hmap-4/jackson-databind=not
|affected,sam-1/jackson-data |affected,sam-1/jackson-data
|bind=wontfix,rhev-m-3/jaspe |bind=wontfix,rhev-m-3/jaspe
|rreports-server-pro=wontfix |rreports-server-pro=wontfix
|/impact=moderate,rhev-m-4/e |/impact=moderate,rhev-m-4/e
|ap7-jackson-databind=wontfi |ap7-jackson-databind=affect
|x/impact=moderate,rhscl-3/r |ed/impact=moderate,rhscl-3/
|h-eclipse46-jackson-databin |rh-eclipse46-jackson-databi
|d=affected,jon-3/Core |nd=affected,jon-3/Core
|Server=notaffected,eap-6/ja |Server=notaffected,eap-6/ja
|ckson-databind=affected,dts |ckson-databind=affected,dts
|-4/devtoolset-4-jackson-dat |-4/devtoolset-4-jackson-dat
|abind=affected,rhscl-3/rh-m |abind=affected,rhscl-3/rh-m
|aven35-jackson-databind=aff |aven35-jackson-databind=aff
|ected |ected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 6 months