[Bug 1397485] New: CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1397485
Bug ID: 1397485
Summary: CVE-2016-8735 tomcat: Remote code execution
vulnerability in JmxRemoteLifecycleListener
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aileenc(a)redhat.com, alee(a)redhat.com,
aszczucz(a)redhat.com, bbaranow(a)redhat.com,
bdawidow(a)redhat.com, bgollahe(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
epp-bugs(a)redhat.com, felias(a)redhat.com,
fnasser(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, hfnukal(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
jason.greene(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jshepherd(a)redhat.com,
kanderso(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, lmeyer(a)redhat.com,
mbabacek(a)redhat.com, mbaluch(a)redhat.com,
me(a)coolsvap.net, miburman(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
mnewsome(a)redhat.com, mweiler(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
ohudlick(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rsvoboda(a)redhat.com, rzima(a)redhat.com,
spinder(a)redhat.com, theute(a)redhat.com,
trick(a)vanstaveren.us, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix
for CVE-2016-3427. Therefore, Tomcat installations using this listener remained
vulnerable to a similar remote code execution vulnerability. This issue has
been rated as important rather than critical due to the small number of
installations using this listener and that it would be highly unusual for the
JMX ports to be accessible to an attacker even when the listener is used.
Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6
Upstream patches:
Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767684
Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767676
Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767656
Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767646
External References:
https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1482091] CVE-2017-1000107 jenkins-plugin-script-security, jenkins-plugin-workflow-cps: Multiple Groovy language features allowed Script Security Plugin sandbox bypass
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1482091
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|70807,reported=20170807,sou |70807,reported=20170807,sou
|rce=internet,cvss3=8.8/CVSS |rce=internet,cvss3=8.8/CVSS
|:3.0/AV:N/AC:L/PR:L/UI:N/S: |:3.0/AV:N/AC:L/PR:L/UI:N/S:
|U/C:H/I:H/A:H,cwe=CWE-184,o |U/C:H/I:H/A:H,cwe=CWE-184,o
|penshift-enterprise-3/jenki |penshift-enterprise-3/jenki
|ns-plugin-workflow-cps=new, |ns-plugin-workflow-cps=wont
|openshift-enterprise-3/jenk |fix,openshift-enterprise-3/
|ins-plugin-script-security= |jenkins-plugin-script-secur
|new,fedora-all/jenkins-scri |ity=wontfix,fedora-all/jenk
|pt-security-plugin=affected |ins-script-security-plugin=
| |affected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1467570] New: Update Netty to 4.0.44+
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1467570
Bug ID: 1467570
Summary: Update Netty to 4.0.44+
Product: Fedora
Version: rawhide
Component: netty
Assignee: msimacek(a)redhat.com
Reporter: trepik(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: ctubbsii(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, msimacek(a)redhat.com
The latest release of Cassandra (3.11) requires newer version of Netty (4.0.44)
I'd like to update Cassandra in rawhide and having new Netty as well would be
nice. I can help with the update if needed.
It's not only Cassandra but also mongo-java-driver that requires newer version
of Netty.
Thanks
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months