[Bug 1599886] New: CVE-2018-1337 apache-ldap-api: Plaintext Password Disclosure in Secured Channel
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1599886
Bug ID: 1599886
Summary: CVE-2018-1337 apache-ldap-api: Plaintext Password
Disclosure in Secured Channel
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: chazlett(a)redhat.com, drieden(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jolee(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, puntogil(a)libero.it,
vhalbert(a)redhat.com
In Apache LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made
it possible for another thread to use the connection before the TLS layer has
been established, if the connection has already been used and put back in a
pool of connections, leading to leaking any information contained in this
request (including the credentials when sending a BIND request).
References:
https://lists.apache.org/thread.html/d66081195e9a02ee7cc20fb243b60467d141...
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1637492] New: CVE-2018-11797 pdfbox: unbounded computation in parser resulting in a denial of service
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1637492
Bug ID: 1637492
Summary: CVE-2018-11797 pdfbox: unbounded computation in parser
resulting in a denial of service
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abergmann(a)suse.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, anstephe(a)redhat.com,
bkearney(a)redhat.com, chazlett(a)redhat.com,
drieden(a)redhat.com, etirelli(a)redhat.com,
ggainey(a)redhat.com, gvarsami(a)redhat.com,
hghasemb(a)redhat.com, ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jolee(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lpetrovi(a)redhat.com, meissner(a)suse.de,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pszubiak(a)redhat.com, puntogil(a)libero.it,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
sdaley(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com, tlestach(a)redhat.com,
vhalbert(a)redhat.com
A vulnerability related to parsing was found in Apache PDFBox parser. A
carefully crafted PDF file can trigger an extremely long running computation
when parsing the page tree.
External References:
https://lists.apache.org/thread.html/a9760973a873522f4d4c0a99916ceb74f361...
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1637494] New: CVE-2018-11797 pdfbox: unbounded computation in parser resulting in a denial of service [ fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1637494
Bug ID: 1637494
Summary: CVE-2018-11797 pdfbox: unbounded computation in parser
resulting in a denial of service [fedora-all]
Product: Fedora
Version: 28
Component: pdfbox
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: puntogil(a)libero.it
Reporter: anemec(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1636799] New: Checksum validation for some ant-findbugs package
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1636799
Bug ID: 1636799
Summary: Checksum validation for some ant-findbugs package
Product: Fedora
Version: rawhide
Component: ant
Severity: high
Assignee: mizdebsk(a)redhat.com
Reporter: grgoffe(a)yahoo.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Description of problem: ran "dnf reinstall ant'*'" and got checksum error
messages for several ant and antlr packages.
Version-Release number of selected component (if applicable):
ant-findbugs-3.0.1-15.fc29.noarch
How reproducible:
always for now
Steps to Reproduce:
1.see above
2.
3.
Actual results:
see below
Expected results:
Additional info:
[MIRROR] ant-findbugs-3.0.1-15.fc29.noarch.rpm: Downloading successful, but
checksum doesn't match. Calculated:
78a182ffcce150030c4ab68ba8483b95ecd597240aa23a6136f0e5a876101ff8(sha256)
Expected:
1caf30204212c95d4b3d3cc96a01c2c262b010485f1793789fba9db506702414(sha256)
[MIRROR] ant-findbugs-3.0.1-15.fc29.noarch.rpm: Downloading successful, but
checksum doesn't match. Calculated:
78a182ffcce150030c4ab68ba8483b95ecd597240aa23a6136f0e5a876101ff8(sha256)
Expected:
1caf30204212c95d4b3d3cc96a01c2c262b010485f1793789fba9db506702414(sha256)
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1636800] New: some antlr and anthy packages have checksum errors
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1636800
Bug ID: 1636800
Summary: some antlr and anthy packages have checksum errors
Product: Fedora
Version: rawhide
Component: antlr3
Severity: high
Assignee: mizdebsk(a)redhat.com
Reporter: grgoffe(a)yahoo.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dingyichen(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, projects.rg(a)smart.ms,
walters(a)redhat.com
Description of problem:ran "dnf reinstall ant'*'" and got some checksum error
messages for antlr and anthy packages
Version-Release number of selected component (if applicable):
antlr-tool-2.7.7-55.fc29.noarch
antlr4-runtime-4.5.2-6.fc30.noarch
antlr32-java-3.2-20.fc29.noarch
anthy-9100h-36.fc29.x86_64
How reproducible:
always for now
Steps to Reproduce:
1.see above
2.
3.
Actual results:
see below
Expected results:
Additional info:
(22/25): antlr-tool-2.7.7-55.fc29.noarch.rpm
394 kB/s | 355 kB 00:00
[MIRROR] antlr32-java-3.2-20.fc29.noarch.rpm: Downloading successful, but
checksum doesn't match. Calculated:
0188e635f46c4f80308f6c6eff26939baa86fdb705606345741d3e7fe7afd1c2(sha256)
Expected:
fdb4cac44c70d21b9999260200cef018a113704b51aa6d0c305c087dc954c979(sha256)
(23/25): antlr4-runtime-4.5.2-6.fc30.noarch.rpm
404 kB/s | 288 kB 00:00
[MIRROR] antlr32-java-3.2-20.fc29.noarch.rpm: Downloading successful, but
checksum doesn't match. Calculated:
0188e635f46c4f80308f6c6eff26939baa86fdb705606345741d3e7fe7afd1c2(sha256)
Expected:
fdb4cac44c70d21b9999260200cef018a113704b51aa6d0c305c087dc954c979(sha256)
(24/25): antlr32-java-3.2-20.fc29.noarch.rpm
79 kB/s | 153 kB 00:01
[MIRROR] anthy-9100h-36.fc29.x86_64.rpm: Downloading successful, but checksum
doesn't match. Calculated:
5b7dba1fac34751f7257b56662d9e6022cdf8099d3d5351c3753a80877ef31f1(sha256)
Expected:
b00283a05a74df68d326ab86709e24ee2baf4bb96fd80d9aa42aa0233a187432(sha256)
[MIRROR] anthy-9100h-36.fc29.x86_64.rpm: Downloading successful, but checksum
doesn't match. Calculated:
5b7dba1fac34751f7257b56662d9e6022cdf8099d3d5351c3753a80877ef31f1(sha256)
Expected:
b00283a05a74df68d326ab86709e24ee2baf4bb96fd80d9aa42aa0233a187432(sha256)
(25/25): anthy-9100h-36.fc29.x86_64.rpm
390 kB/s | 6.1 MB 00:15
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1636514] New: CVE-2018-11784 tomcat: Open redirect in default servlet [epel-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1636514
Bug ID: 1636514
Summary: CVE-2018-11784 tomcat: Open redirect in default
servlet [epel-all]
Product: Fedora EPEL
Version: epel7
Component: tomcat
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: ivan.afonichev(a)gmail.com
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora EPEL. While
only one tracking bug has been filed, please correct all affected versions
at the same time. If you need to fix the versions independent of each
other, you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1636513] New: CVE-2018-11784 tomcat: Open redirect in default servlet [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1636513
Bug ID: 1636513
Summary: CVE-2018-11784 tomcat: Open redirect in default
servlet [fedora-all]
Product: Fedora
Version: 28
Component: tomcat
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: ivan.afonichev(a)gmail.com
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1632469] CVE-2018-11762 tika: Zip Slip vulnerability in tika-app
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1632469
Tomas Hoger <thoger(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC|java-maint(a)redhat.com |
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0919,reported=20180919,sour |0919,reported=20180919,sour
|ce=cve,cvss3=7.5/CVSS:3.0/A |ce=cve,cvss3=7.5/CVSS:3.0/A
|V:N/AC:L/PR:N/UI:N/S:U/C:N/ |V:N/AC:L/PR:N/UI:N/S:U/C:N/
|I:N/A:H,cwe=CWE-20,rhel-8/t |I:N/A:H,cwe=CWE-20,fedora-a
|ika=affected,fedora-all/tik |ll/tika=affected,rhscl-3/rh
|a=affected,rhscl-3/rh-eclip |-eclipse46-tika=notaffected
|se46-tika=notaffected,fis-2 |,fis-2/tika-core=new,fuse-7
|/tika-core=new,fuse-7/camel |/camel-tika=new,fsw-6/tika-
|-tika=new,fsw-6/tika-core=n |core=new,brms-5/tika-core=n
|ew,brms-5/tika-core=notaffe |otaffected,brms-6/tika-core
|cted,brms-6/tika-core=new,b |=new,bpms-6/tika-core=new,j
|pms-6/tika-core=new,jdv-6/t |dv-6/tika-core=new,rhn_sate
|ika-core=new,rhn_satellite_ |llite_5/tika=new
|5/tika=new |
--- Comment #3 from Tomas Hoger <thoger(a)redhat.com> ---
The tika packages as shipped as part of the Eclipse collections do not include
tika-app and are therefore unaffected by this issue.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months