[Bug 1482091] CVE-2017-1000107 jenkins-plugin-script-security, jenkins-plugin-workflow-cps: Multiple Groovy language features allowed Script Security Plugin sandbox bypass
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1482091
Adam Mariš <amaris(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |java-sig-commits(a)lists.fedo
| |raproject.org,
| |mizdebsk(a)redhat.com,
| |msrb(a)redhat.com
Whiteboard|impact=important,public=201 |impact=important,public=201
|70807,reported=20170807,sou |70807,reported=20170807,sou
|rce=internet,cvss3=8.8/CVSS |rce=internet,cvss3=8.8/CVSS
|:3.0/AV:N/AC:L/PR:L/UI:N/S: |:3.0/AV:N/AC:L/PR:L/UI:N/S:
|U/C:H/I:H/A:H,cwe=CWE-184,o |U/C:H/I:H/A:H,cwe=CWE-184,o
|penshift-enterprise-3/jenki |penshift-enterprise-3/jenki
|ns-plugin-workflow-cps=new, |ns-plugin-workflow-cps=new,
|openshift-enterprise-3/jenk |openshift-enterprise-3/jenk
|ins-plugin-script-security= |ins-plugin-script-security=
|new,fedora-all/jenkins-plug |new,fedora-all/jenkins-scri
|in-script-security=affected |pt-security-plugin=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1378038] New: xmvn-install: Manifest injection skipped
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1378038
Bug ID: 1378038
Summary: xmvn-install: Manifest injection skipped
Product: Fedora
Version: rawhide
Component: xmvn
Assignee: mizdebsk(a)redhat.com
Reporter: msimacek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
Description of problem:
For some JAR files, manifest injection gets skipped, even though they have a
manifest.
From debug log:
[TRACE] Manifest injection skipped: no pre-existing manifest found to update
Version-Release number of selected component (if applicable):
xmvn-install-2.5.0-15.fc26.noarch
How reproducible:
always
Steps to Reproduce:
1. rebuild ecj package
Actual results:
Manifest injection doesn't happen.
Expected results:
Manifest is injected into all JARs.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1481373] New: CVE-2017-7957 XStream: DoS when unmarshalling void type [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1481373
Bug ID: 1481373
Summary: CVE-2017-7957 XStream: DoS when unmarshalling void
type [fedora-all]
Product: Fedora
Version: 26
Component: xstream
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: mizdebsk(a)redhat.com
Reporter: kseifried(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1469486] New: jctools 2.0.2 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1469486
Bug ID: 1469486
Summary: jctools 2.0.2 is available
Product: Fedora
Version: rawhide
Component: jctools
Assignee: puntogil(a)libero.it
Reporter: msimacek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Latest version in Fedora rawhide: jctools-0:1.2.1-2.fc26.noarch
Latest version on maven central: 2.0.2
jctools 2 is required for netty 4.1 upgrade
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months