[Bug 1408164] New: CVE-2016-9878 Spring Framework: Directory Traversal in the Spring Framework ResourceServlet
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1408164
Bug ID: 1408164
Summary: CVE-2016-9878 Spring Framework: Directory Traversal in
the Spring Framework ResourceServlet
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, aszczucz(a)redhat.com,
avibelli(a)redhat.com, awels(a)redhat.com,
bazulay(a)redhat.com, bdawidow(a)redhat.com,
bmcclain(a)redhat.com, chazlett(a)redhat.com,
coneill(a)redhat.com, dandread(a)redhat.com,
dblechte(a)redhat.com, dmcphers(a)redhat.com,
eedri(a)redhat.com, epp-bugs(a)redhat.com,
etirelli(a)redhat.com, felias(a)redhat.com,
fnasser(a)redhat.com, gklein(a)redhat.com,
gsterlin(a)redhat.com, gvarsami(a)redhat.com,
hchiorea(a)redhat.com, hfnukal(a)redhat.com,
huwang(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jbalunas(a)redhat.com, jbpapp-maint(a)redhat.com,
jcoleman(a)redhat.com, jialiu(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jpallich(a)redhat.com, jshepherd(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lmeyer(a)redhat.com,
lpetrovi(a)redhat.com, lsurette(a)redhat.com,
mbaluch(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mmccomas(a)redhat.com,
mweiler(a)redhat.com, mwinkler(a)redhat.com,
myarboro(a)redhat.com, nthomas(a)redhat.com,
nwallace(a)redhat.com, oourfali(a)redhat.com,
pavelp(a)redhat.com, puntogil(a)libero.it,
rbalakri(a)redhat.com, Rhev-m-bugs(a)redhat.com,
rrajasek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sankarshan(a)redhat.com,
sbonazzo(a)redhat.com, sherold(a)redhat.com,
sisharma(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
srevivo(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tiwillia(a)redhat.com,
tjay(a)redhat.com, tkirby(a)redhat.com, twalsh(a)redhat.com,
vhalbert(a)redhat.com, ydary(a)redhat.com,
ykaul(a)redhat.com
It was found that paths provided to the ResourceServlet were not properly
sanitized and as a result exposed to directory traversal attacks.
Upstream bug:
https://jira.spring.io/browse/SPR-14946
Upstream patches:
https://github.com/spring-projects/spring-framework/commit/e2d6e709c3c65a...
https://github.com/spring-projects/spring-framework/commit/43bf008fbcd0d7...
https://github.com/spring-projects/spring-framework/commit/a7dc48534ea501...
External References:
https://pivotal.io/security/cve-2016-9878
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 6 months
[Bug 1404645] New: CVE-2016-681 activemq: Cross-site scripting in web based administration console
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1404645
Bug ID: 1404645
Summary: CVE-2016-681 activemq: Cross-site scripting in web
based administration console
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, agrimm(a)gmail.com,
aileenc(a)redhat.com, ccoleman(a)redhat.com,
chazlett(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com, gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jgoulding(a)redhat.com,
jialiu(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kconner(a)redhat.com,
kseifried(a)redhat.com, ldimaggi(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
puntogil(a)libero.it, rwagner(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com, s(a)shk.io,
tcunning(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com, tkirby(a)redhat.com
An instance of a cross-site scripting vulnerability was identified to be
present in the web based administration console. The root cause of this issue
is improper user data output validation.
Affected versions: ActiveMQ 5.0.0 - 5.14.1
External Reference:
http://activemq.apache.org/security-advisories.data/CVE-2016-6810-announc...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 6 months
[Bug 1413340] New: fop doesn't include fontbox on classpath
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1413340
Bug ID: 1413340
Summary: fop doesn't include fontbox on classpath
Product: Fedora
Version: 25
Component: fop
Severity: low
Assignee: r.landmann(a)redhat.com
Reporter: brad(a)facefault.org
QA Contact: extras-qa(a)fedoraproject.org
CC: c.david86(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
rhbugs(a)n-dimensional.de, r.landmann(a)redhat.com
Description of problem:
fop requires fontbox for OpenType CFF fonts; fontbox is a dependency of the
rpm, but is not used by the /usr/bin/fop script.
Version-Release number of selected component (if applicable):
2.0-3.fc24 (yes, this is from the FC25 repo)
How reproducible:
Steps to Reproduce:
1. Use fop to process an FO file that uses an .otf font (e.g. Junction from
tlomt-junction-fonts).
Actual results:
An error is displayed stating "The Fontbox jar was not found in the classpath.
This is required for OTF CFF ssupport"
Expected results:
The FO is successfully converted to PDF without errors.
Additional info:
fontbox is missing from the set_classpath call at ll 28-30 of fop.script.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 7 months
[Bug 719628] New: Please build jtidy for EPEL 6
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: Please build jtidy for EPEL 6
https://bugzilla.redhat.com/show_bug.cgi?id=719628
Summary: Please build jtidy for EPEL 6
Product: Fedora
Version: rawhide
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: unspecified
Priority: unspecified
Component: jtidy
AssignedTo: SpikeFedora(a)gmail.com
ReportedBy: redhat-bugzilla(a)linuxnetz.de
QAContact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, robert.scheck(a)etes.de,
SpikeFedora(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org
Classification: Fedora
Story Points: ---
Description of problem:
Please build jtidy from Fedora 15 for EPEL 6, because it is required to
build dom4j in EPEL 6.
Version-Release number of selected component (if applicable):
jtidy-1.0-0.10.20100930svn1125.fc15
Additional info:
Please let me know, if you just don't want to be the maintainer for the
jtidy EPEL 6 package...
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
6 years, 7 months
[Bug 1329272] New: Could not find artifact org.gradle:gradle-base-services:jar:2.8 in mizdebsk-redhat (http://people.redhat.com/~mizdebsk/xmvn/repo/)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1329272
Bug ID: 1329272
Summary: Could not find artifact
org.gradle:gradle-base-services:jar:2.8 in
mizdebsk-redhat
(http://people.redhat.com/~mizdebsk/xmvn/repo/)
Product: Fedora
Version: rawhide
Component: xmvn
Assignee: mizdebsk(a)redhat.com
Reporter: matthias(a)mailaender.name
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
Description of problem:
I tried to build xmvn locally on openSUSE Tumbleweed.
Version-Release number of selected component (if applicable):
xmvn-2.5.0
Steps to Reproduce:
mvn -B clean install
[...]
[INFO] XMvn Connector for Gradle .......................... FAILURE [ 5.718 s]
[...]
[ERROR] Failed to execute goal on project xmvn-connector-gradle: Could not
resolve dependencies for project
org.fedoraproject.xmvn:xmvn-connector-gradle:jar:2.5.0: The following artifacts
could not be resolved: org.gradle:gradle-base-services:jar:2.8,
org.gradle:gradle-base-services-groovy:jar:2.8, org.gradle:gradle-core:jar:2.8,
org.gradle:gradle-dependency-management:jar:2.8,
org.gradle:gradle-resources:jar:2.8: Could not find artifact
org.gradle:gradle-base-services:jar:2.8 in mizdebsk-redhat
(http://people.redhat.com/~mizdebsk/xmvn/repo/) -> [Help 1]
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 7 months