[Bug 1377280] New: CVE-2016-5017 zookeeper: Buffer overflow vulnerability in C cli shell
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1377280
Bug ID: 1377280
Summary: CVE-2016-5017 zookeeper: Buffer overflow vulnerability
in C cli shell
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, aszczucz(a)redhat.com,
chazlett(a)redhat.com, ctubbsii(a)fedoraproject.org,
dmcphers(a)redhat.com, ethan(a)ethantuttle.com,
etirelli(a)redhat.com, felias(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jialiu(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lmeyer(a)redhat.com, lpetrovi(a)redhat.com,
mbaluch(a)redhat.com, mmccomas(a)redhat.com,
mwinkler(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, rrajasek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com, s(a)shk.io,
tcunning(a)redhat.com, tiwillia(a)redhat.com,
tkirby(a)redhat.com, tstclair(a)redhat.com,
vhalbert(a)redhat.com
The ZooKeeper C client shells "cli_st" and "cli_mt" have a buffer overflow
vulnerability associated with parsing of the input command when using the
"cmd:<cmd>" batch mode syntax. If the command string exceeds 1024 characters a
buffer overflow will occur. There is no known compromise which takes advantage
of this vulnerability, and if security is enabled the attacker would be limited
by client level security constraints. The C cli shell is intended as a
sample/example of how to use the C client interface, not as a production tool -
the documentation has also been clarified on this point.
References:
http://seclists.org/bugtraq/2016/Sep/29
Upstream fix:
https://git-wip-us.apache.org/repos/asf?p=zookeeper.git;a=commitdiff;h=27...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years
[Bug 1422148] New: tomcat: Infinite loop in the processing of https requests
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1422148
Bug ID: 1422148
Summary: tomcat: Infinite loop in the processing of https
requests
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: alee(a)redhat.com, bbaranow(a)redhat.com,
bmaxwell(a)redhat.com, cdewolf(a)redhat.com,
csutherl(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dosoudil(a)redhat.com,
gzaronik(a)redhat.com, hhorak(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jdoyle(a)redhat.com, jorton(a)redhat.com,
krzysztof.daniel(a)gmail.com, lgao(a)redhat.com,
mbabacek(a)redhat.com, me(a)coolsvap.net,
mizdebsk(a)redhat.com, myarboro(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rsvoboda(a)redhat.com, trick(a)vanstaveren.us,
twalsh(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com
It was discovered that a programming error in the processing of HTTPS requests
in the Apache Tomcat servlet and JSP engine may result in denial of service via
an infinite loop.
Upstream patch:
https://github.com/apache/tomcat80/commit/614e7f78aecc429d8740bb59900c2f9...
Upstream bug:
https://bz.apache.org/bugzilla/show_bug.cgi?id=57544
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 1 month
[Bug 1427189] New: Unresolved OSGi requirement breaks Eclipse help system
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1427189
Bug ID: 1427189
Summary: Unresolved OSGi requirement breaks Eclipse help system
Product: Fedora
Version: rawhide
Component: jetty
Assignee: mizdebsk(a)redhat.com
Reporter: mat.booth(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com
Description of problem:
When using the integrated Eclipse help system, I see this error in the log:
!ENTRY org.eclipse.ui 4 0 2017-02-27 14:19:57.069
!MESSAGE Unhandled event loop exception
!STACK 0
java.lang.NoClassDefFoundError:
org/eclipse/equinox/http/jetty/JettyConfigurator
at
org.eclipse.help.internal.server.JettyHelpServer$StartServerThread.run(JettyHelpServer.java:79)
Caused by: java.lang.ClassNotFoundException:
org.eclipse.equinox.http.jetty.JettyConfigurator cannot be found by
org.eclipse.help.base_4.1.2.v20170227-1124
at
org.eclipse.osgi.internal.loader.BundleLoader.findClassInternal(BundleLoader.java:461)
at
org.eclipse.osgi.internal.loader.BundleLoader.findClass(BundleLoader.java:372)
at
org.eclipse.osgi.internal.loader.BundleLoader.findClass(BundleLoader.java:364)
at
org.eclipse.osgi.internal.loader.ModuleClassLoader.loadClass(ModuleClassLoader.java:161)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 1 more
Looking at the OSGi console, I see the following unresolved bundles:
g! ss -s INSTALLED
id State Bundle
97 INSTALLED org.eclipse.equinox.http.jetty_3.3.0.v20170227-1124
143 INSTALLED org.eclipse.jetty.http_9.4.2.v20170220
145 INSTALLED org.eclipse.jetty.security_9.4.2.v20170220
146 INSTALLED org.eclipse.jetty.server_9.4.2.v20170220
147 INSTALLED org.eclipse.jetty.servlet_9.4.2.v20170220
And it seems to be caused by a missing capability:
g! diag 143
org.eclipse.jetty.http [143]
Unresolved requirement: Require-Capability: osgi.extender;
filter:="(osgi.extender=osgi.serviceloader.processor)"
This requirement seems to be new in:
jetty-http-9.4.2-1.v20170220.fc26.noarch
It doesn't look like there is a provider of this capability in Fedora. Any idea
if this requirement can be made optional?
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 1 month
[Bug 1430045] New: "Could not find jaxp_parser_impl" when invoking ant from command line
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1430045
Bug ID: 1430045
Summary: "Could not find jaxp_parser_impl" when invoking ant
from command line
Product: Fedora
Version: 26
Component: ant
Assignee: msimacek(a)redhat.com
Reporter: mat.booth(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com,
mmatejov(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com
If I invoke ant from command line, I see the following error:
[mbooth@fedora26 ~]$ ant
/usr/bin/build-classpath: Could not find jaxp_parser_impl Java extension for
this JVM
/usr/bin/build-classpath: error: Some specified jars were not found
Buildfile: build.xml does not exist!
Build failed
Probably the /usr/bin/ant shell script needs updating. Can jaxp_parser_impl
just be removed?
Installed version:
ant-1.10.1-4.fc26.noarch
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 2 months