[Bug 1403824] New: CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1403824
Bug ID: 1403824
Summary: CVE-2016-8745 tomcat: information disclosure due to
incorrect Processor sharing
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, aszczucz(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
ccoleman(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
dosoudil(a)redhat.com, etirelli(a)redhat.com,
felias(a)redhat.com, fnasser(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, huwang(a)redhat.com,
ivan.afonichev(a)gmail.com, jason.greene(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jshepherd(a)redhat.com,
kconner(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lmeyer(a)redhat.com,
lpetrovi(a)redhat.com, mbabacek(a)redhat.com,
mbaluch(a)redhat.com, me(a)coolsvap.net,
miburman(a)redhat.com, mmccomas(a)redhat.com,
mwinkler(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
trick(a)vanstaveren.us, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
The following flaw was found in Apache Tomcat:
The refactoring of the Connector code for 8.5.x onwards introduced a regression
in the error handling of the send file code for the NIO HTTP connector. An
error during send file processing resulted in the current Processor object
being added to the Processor cache multiple times. This in turn meant that the
same Processor could be used for concurrent requests. Sharing a Processor can
result in information leakage between requests including, not limited to,
session ID and the response body.
This issue affects only versions 8.5.x and later.
Upstream patch:
8.x: https://svn.apache.org/viewvc?view=revision&revision=1771857
9.x: https://svn.apache.org/viewvc?view=revision&revision=1771853
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1418716] New: CVE-2017-2605 jenkins: Re-key admin monitor leaves behind unencrypted credentials in upgraded installations (SECURITY-376)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1418716
Bug ID: 1418716
Summary: CVE-2017-2605 jenkins: Re-key admin monitor leaves
behind unencrypted credentials in upgraded
installations (SECURITY-376)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all
secrets in JENKINS_HOME with a new key. It also created a backup directory with
all old secrets, and the key used to encrypt them. These backups were
world-readable and not removed afterwards.
Jenkins now deletes the backup directory, if present. Upgrading from before
1.498 will no longer create a backup directory. Administrators relying on file
access permissions in their manually created backups are advised to check them
for the directory
$JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups, and delete it
if present.
All administrative monitors now require the user accessing them to be an
administrator.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/0be33cf7328fad6a7596ce9505a74...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1474286] New: CVE-2017-5528 jasperrreports: XSS and CSRF vulnerabilities leading to information disclosure
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1474286
Bug ID: 1474286
Summary: CVE-2017-5528 jasperrreports: XSS and CSRF
vulnerabilities leading to information disclosure
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bmcclain(a)redhat.com, dblechte(a)redhat.com,
eedri(a)redhat.com, gklein(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
lsurette(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, puntogil(a)libero.it,
rbalakri(a)redhat.com, Rhev-m-bugs(a)redhat.com,
sherold(a)redhat.com, srevivo(a)redhat.com,
ydary(a)redhat.com, ykaul(a)redhat.com
The JasperReports Server components listed above contain vulnerabilities which
may allow authorized users to perform cross-site scripting (XSS) and cross-site
request forgery (CSRF) attacks. The impact of this vulnerability includes the
theoretical disclosure of sensitive information. Affects TIBCO JasperReports
Server (versions 6.1.1 and below, 6.2.0, 6.2.1, and 6.3.0), TIBCO JasperReports
Server Community Edition (versions 6.3.0 and below), TIBCO JasperReports Server
for ActiveMatrix BPM (versions 6.2.0 and below), TIBCO Jaspersoft for AWS with
Multi-Tenancy (versions 6.2.0 and below), and TIBCO Jaspersoft Reporting and
Analytics for AWS (versions 6.2.0 and below).
External References:
https://www.tibco.com/support/advisories/2017/06/tibco-security-advisory-...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1474288] CVE-2017-5529 jasperrreports: Information disclosure vulnerability
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1474288
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0628,reported=20170629,sour |0628,reported=20170629,sour
|ce=cve,cvss3=4.1/CVSS:3.0/A |ce=cve,cvss3=4.1/CVSS:3.0/A
|V:N/AC:L/PR:L/UI:R/S:C/C:L/ |V:N/AC:L/PR:L/UI:R/S:C/C:L/
|I:N/A:N,cwe=CWE-200,rhev-m- |I:N/A:N,cwe=CWE-200,rhev-m-
|3/jasperreports-server-pro= |3/jasperreports-server-pro=
|new,fedora-all/jasperreport |wontfix,fedora-all/jasperre
|s=affected |ports=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
Broken dependencies: aether-ant-tasks
by buildsys@fedoraproject.org
aether-ant-tasks has broken dependencies in the rawhide tree:
On x86_64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On armhfp:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64le:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On aarch64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On i386:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
Please resolve this as soon as possible.
6 years, 10 months