[Bug 1413505] New: CVE-2016-6814 groovy18: Apache Groovy: Information disclosure [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1413505
Bug ID: 1413505
Summary: CVE-2016-6814 groovy18: Apache Groovy: Information
disclosure [fedora-all]
Product: Fedora
Version: 25
Component: groovy18
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: puntogil(a)libero.it
Reporter: amaris(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1397485] New: CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1397485
Bug ID: 1397485
Summary: CVE-2016-8735 tomcat: Remote code execution
vulnerability in JmxRemoteLifecycleListener
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aileenc(a)redhat.com, alee(a)redhat.com,
aszczucz(a)redhat.com, bbaranow(a)redhat.com,
bdawidow(a)redhat.com, bgollahe(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
epp-bugs(a)redhat.com, felias(a)redhat.com,
fnasser(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, hfnukal(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
jason.greene(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jshepherd(a)redhat.com,
kanderso(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, lmeyer(a)redhat.com,
mbabacek(a)redhat.com, mbaluch(a)redhat.com,
me(a)coolsvap.net, miburman(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
mnewsome(a)redhat.com, mweiler(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
ohudlick(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rsvoboda(a)redhat.com, rzima(a)redhat.com,
spinder(a)redhat.com, theute(a)redhat.com,
trick(a)vanstaveren.us, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix
for CVE-2016-3427. Therefore, Tomcat installations using this listener remained
vulnerable to a similar remote code execution vulnerability. This issue has
been rated as important rather than critical due to the small number of
installations using this listener and that it would be highly unusual for the
JMX ports to be accessible to an attacker even when the listener is used.
Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6
Upstream patches:
Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767684
Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767676
Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767656
Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767646
External References:
https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1467570] New: Update Netty to 4.0.44+
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1467570
Bug ID: 1467570
Summary: Update Netty to 4.0.44+
Product: Fedora
Version: rawhide
Component: netty
Assignee: msimacek(a)redhat.com
Reporter: trepik(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: ctubbsii(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, msimacek(a)redhat.com
The latest release of Cassandra (3.11) requires newer version of Netty (4.0.44)
I'd like to update Cassandra in rawhide and having new Netty as well would be
nice. I can help with the update if needed.
It's not only Cassandra but also mongo-java-driver that requires newer version
of Netty.
Thanks
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1378038] New: xmvn-install: Manifest injection skipped
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1378038
Bug ID: 1378038
Summary: xmvn-install: Manifest injection skipped
Product: Fedora
Version: rawhide
Component: xmvn
Assignee: mizdebsk(a)redhat.com
Reporter: msimacek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
Description of problem:
For some JAR files, manifest injection gets skipped, even though they have a
manifest.
From debug log:
[TRACE] Manifest injection skipped: no pre-existing manifest found to update
Version-Release number of selected component (if applicable):
xmvn-install-2.5.0-15.fc26.noarch
How reproducible:
always
Steps to Reproduce:
1. rebuild ecj package
Actual results:
Manifest injection doesn't happen.
Expected results:
Manifest is injected into all JARs.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1469486] New: jctools 2.0.2 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1469486
Bug ID: 1469486
Summary: jctools 2.0.2 is available
Product: Fedora
Version: rawhide
Component: jctools
Assignee: puntogil(a)libero.it
Reporter: msimacek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Latest version in Fedora rawhide: jctools-0:1.2.1-2.fc26.noarch
Latest version on maven central: 2.0.2
jctools 2 is required for netty 4.1 upgrade
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1476055] New: takari-incrementalbuild-0.20.5 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1476055
Bug ID: 1476055
Summary: takari-incrementalbuild-0.20.5 is available
Product: Fedora
Version: rawhide
Component: takari-incrementalbuild
Keywords: FutureFeature, Triaged
Assignee: mizdebsk(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
Latest upstream release: 0.20.5
Current version/release in rawhide: 0.20.4-2.fc26
URL: http://takari.io
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/9579/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1473260] New: CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper [ fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1473260
Bug ID: 1473260
Summary: CVE-2017-7525 jackson-databind: Deserialization
vulnerability via readValue method of ObjectMapper
[fedora-all]
Product: Fedora
Version: 26
Component: jackson-databind
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: puntogil(a)libero.it
Reporter: rasanche(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1409838] New: CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1409838
Bug ID: 1409838
Summary: CVE-2016-9879 Spring Security: Improper handling of
path parameters allows bypassing the security
constraint
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
bmcclain(a)redhat.com, chazlett(a)redhat.com,
dblechte(a)redhat.com, dmcphers(a)redhat.com,
eedri(a)redhat.com, gklein(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
lsurette(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mmccomas(a)redhat.com,
puntogil(a)libero.it, rbalakri(a)redhat.com,
Rhev-m-bugs(a)redhat.com, sbonazzo(a)redhat.com,
sherold(a)redhat.com, srevivo(a)redhat.com,
tiwillia(a)redhat.com, ydary(a)redhat.com,
ykaul(a)redhat.com
Spring Security does not consider URL path parameters when processing security
constraints. By adding a URL path parameter with an encoded "/" to a request,
an attacker may be able to bypass a security constraint. The root cause of this
issue is a lack of clarity regarding the handling of path parameters in the
Servlet Specification (see below). Some Servlet containers include path
parameters in the value returned for getPathInfo() and some do not. Spring
Security uses the value returned by getPathInfo() as part of the process of
mapping requests to security constraints. The unexpected presence of path
parameters can cause a constraint to be bypassed.
Users of Apache Tomcat (all current versions) are not affected by this
vulnerability since Tomcat follows the guidance previously provided by the
Servlet Expert group and strips path parameters from the value returned by
getContextPath(), getServletPath() and getPathInfo().
Users of other Servlet containers based on Apache Tomcat may or may not be
affected depending on whether or not the handling of path parameters has been
modified.
Users of IBM WebSphere Application Server 8.5.x are known to be affected.
Users of other containers that implement the Servlet specification may be
affected.
Mitigation:
Use a Servlet container known not to include path parameters in the return
values for getServletPath() and getPathInfo()
Upstream bug:
https://github.com/spring-projects/spring-security/issues/4169
External Reference:
https://pivotal.io/security/cve-2016-9879
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months