[Bug 1480626] New: CVE-2017-7675 tomcat: Security Constraint Bypass
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1480626
Bug ID: 1480626
Summary: CVE-2017-7675 tomcat: Security Constraint Bypass
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: alee(a)redhat.com, csutherl(a)redhat.com,
gzaronik(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jclere(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net,
myarboro(a)redhat.com, trick(a)vanstaveren.us,
twalsh(a)redhat.com, weli(a)redhat.com
The HTTP/2 implementation bypassed a number of security checks that prevented
directory traversal attacks. It was therefore possible to bypass security
constraints using an specially crafted URL.
Affected versions: 8.5.0 to 8.5.15
External References:
https://tomcat.apache.org/security-8.html
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1481005] rpmbuild traceback by building
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1481005
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |ERRATA
Last Closed|2017-08-19 18:30:44 |2017-08-22 16:44:13
--- Comment #10 from Fedora Update System <updates(a)fedoraproject.org> ---
javapackages-tools-4.7.0-17.fc26 has been pushed to the Fedora 26 stable
repository. If problems still persist, please make note of it in this bug
report.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1481005] rpmbuild traceback by building
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1481005
Mikolaj Izdebski <mizdebsk(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|CLOSED |ON_QA
Resolution|NEXTRELEASE |---
--- Comment #9 from Mikolaj Izdebski <mizdebsk(a)redhat.com> ---
(In reply to Dominik Kucher from comment #8)
> it works with the new javapackages-tools, i have download it few days agon
> from koji and test it that's why i have close the bug
Thank you for confirming this. But the fix is not yet delivered to end users,
so the bug should stay open for now, until erratum is pushed to stable updates
repository.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1481005] rpmbuild traceback by building
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1481005
Dominik Kucher <d.kucher(a)dk-software.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Resolution|--- |NEXTRELEASE
Last Closed|2017-08-17 08:50:37 |2017-08-19 18:30:44
--- Comment #8 from Dominik Kucher <d.kucher(a)dk-software.org> ---
it works with the new javapackages-tools, i have download it few days agon from
koji and test it that's why i have close the bug
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1434523] New: CVE-2017-5644 apache-poi: XML entity expansion via specially crafted OOXML file [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1434523
Bug ID: 1434523
Summary: CVE-2017-5644 apache-poi: XML entity expansion via
specially crafted OOXML file [fedora-all]
Product: Fedora
Version: 25
Component: apache-poi
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: mat.booth(a)redhat.com
Reporter: anemec(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, puntogil(a)libero.it
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months