[Bug 1599015] New: antlr4: python 3 runtime support
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1599015
Bug ID: 1599015
Summary: antlr4: python 3 runtime support
Product: Fedora
Version: rawhide
Component: antlr4
Severity: medium
Assignee: mizdebsk(a)redhat.com
Reporter: loganjerry(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jkastner(a)redhat.com, lef(a)fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
projects.rg(a)smart.ms, puntogil(a)libero.it
Description of problem:
A new version of coq has been released. It requires the antlr4 4.7.1 python 3
runtime support package. When you update to version 4.7.1, would you please
also make a subpackage for the python 3 runtime? Thank you.
Version-Release number of selected component (if applicable):
N/A
How reproducible:
N/A
Steps to Reproduce:
1.
2.
3.
Actual results:
N/A
Expected results:
N/A
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 4 months
[Bug 1652285] New: pdfbox-examples uninstallable
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1652285
Bug ID: 1652285
Summary: pdfbox-examples uninstallable
Product: Fedora
Version: 29
Component: pdfbox
Assignee: puntogil(a)libero.it
Reporter: phil(a)fifi.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Description of problem:
pdfbox-examples cannot be installed.
Version-Release number of selected component (if applicable):
pdfbox-examples-2.0.9-2.fc29.noarch
How reproducible:
Always
Steps to Reproduce:
1. dnf install --best --allowerasing pdfbox-examples-2.0.9-2.fc29.noarch
Actual results:
Error:
Problem: cannot install the best candidate for the job
- nothing provides mvn(org.apache.lucene:lucene-analyzers-common:4) needed by
pdfbox-examples-2.0.9-2.fc29.noarch
- nothing provides mvn(org.apache.lucene:lucene-core:4) needed by
pdfbox-examples-2.0.9-2.fc29.noarch
Expected results:
Package should install.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 4 months
[Bug 1607591] New: CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Bug ID: 1607591
Summary: CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can
lead to DoS
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, alee(a)redhat.com,
anstephe(a)redhat.com, apintea(a)redhat.com,
avibelli(a)redhat.com, bgeorges(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmoulliard(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dbaker(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, fgavrilo(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hghasemb(a)redhat.com, hhorak(a)redhat.com,
ibek(a)redhat.com, ikanello(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdoyle(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jondruse(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jschatte(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, loleary(a)redhat.com,
lpetrovi(a)redhat.com, lthon(a)redhat.com,
mbabacek(a)redhat.com, mizdebsk(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, pgier(a)redhat.com,
pjurak(a)redhat.com, ppalaga(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
pszubiak(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sdaley(a)redhat.com,
spinder(a)redhat.com, sstavrev(a)redhat.com,
sthangav(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
trankin(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
Flaw affecting tomcat 8.0.0.RC1 to 8.0.51 and 9.0.0.M1 to 9.0.7. An improper
handing of overflow in the UTF-8 decoder with supplementary characters can lead
to an infinite loop in the decoder causing a Denial of Service.
Upstream patch:
http://svn.apache.org/viewvc?view=rev&rev=1830375
http://svn.apache.org/viewvc?view=rev&rev=1830373
References:
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 4 months
[Bug 1579611] New: CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1579611
Bug ID: 1579611
Summary: CVE-2018-8014 tomcat: Insecure defaults in CORS filter
enable 'supportsCredentials' for all origins
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, alee(a)redhat.com,
anstephe(a)redhat.com, apintea(a)redhat.com,
avibelli(a)redhat.com, bgeorges(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmoulliard(a)redhat.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dbaker(a)redhat.com,
dimitris(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, etirelli(a)redhat.com,
fgavrilo(a)redhat.com, gvarsami(a)redhat.com,
gzaronik(a)redhat.com, hghasemb(a)redhat.com,
hhorak(a)redhat.com, ibek(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdoyle(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jondruse(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jschatte(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, loleary(a)redhat.com,
lpetrovi(a)redhat.com, lthon(a)redhat.com,
mbabacek(a)redhat.com, me(a)coolsvap.net,
mizdebsk(a)redhat.com, mszynkie(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pavelp(a)redhat.com,
pgallagh(a)redhat.com, pgier(a)redhat.com,
pjurak(a)redhat.com, ppalaga(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
pszubiak(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sdaley(a)redhat.com,
spinder(a)redhat.com, sstavrev(a)redhat.com,
sthangav(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
trankin(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
Apache Tomcat through versions 7.0.88, 8.0.52, 8.5.31 and 9.0.8 have defaults
settings for the CORS filter that are insecure and enable 'supportsCredentials'
for all origins.
External References:
https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343...
http://tomcat.apache.org/security-9.html
http://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-7.html
Upstream Patches:
http://svn.apache.org/viewvc?view=rev&rev=1831726
http://svn.apache.org/viewvc?view=rev&rev=1831728
http://svn.apache.org/viewvc?view=rev&rev=1831729
http://svn.apache.org/viewvc?view=rev&rev=1831730
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 4 months
[Bug 1578578] New: CVE-2018-1257 spring-framework: ReDoS Attack with spring-messaging
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1578578
Bug ID: 1578578
Summary: CVE-2018-1257 spring-framework: ReDoS Attack with
spring-messaging
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, apevec(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
chrisw(a)redhat.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dchen(a)redhat.com,
dffrench(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
drusso(a)redhat.com, etirelli(a)redhat.com,
gvarsami(a)redhat.com, hghasemb(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jjoyce(a)redhat.com, jmadigan(a)redhat.com,
jolee(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lgriffin(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lpetrovi(a)redhat.com,
markmc(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, myarboro(a)redhat.com,
ngough(a)redhat.com, nwallace(a)redhat.com,
nyechiel(a)redhat.com, paradhya(a)redhat.com,
pavelp(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
pszubiak(a)redhat.com, puntogil(a)libero.it,
pwright(a)redhat.com, rbryant(a)redhat.com,
rhel8-maint(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sclewis(a)redhat.com,
sdaley(a)redhat.com, sisharma(a)redhat.com,
slinaber(a)redhat.com, smohan(a)redhat.com,
ssaha(a)redhat.com, tcunning(a)redhat.com,
tdecacqu(a)redhat.com, tjay(a)redhat.com,
tkirby(a)redhat.com, trepel(a)redhat.com,
twalsh(a)redhat.com, vbellur(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com
A flaw was found in Spring Framework, versions 5.0.x prior to 5.0.6, versions
4.3.x prior to 4.3.17, and older unsupported versions allows applications to
expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker
through the spring-messaging module. A malicious user (or attacker) can craft a
message to the broker that can lead to a regular expression, denial of service
attack.
References:
https://pivotal.io/security/cve-2018-1257
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 4 months
[Bug 1578902] New: CVE-2018-1259 spring-framework: XXE with Spring Data’s XMLBeam integration
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1578902
Bug ID: 1578902
Summary: CVE-2018-1259 spring-framework: XXE with Spring Data’s
XMLBeam integration
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: dchen(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7,
used in combination with XMLBeam 1.4.14 or earlier versions, contains a
property binder vulnerability caused by improper restriction of XML external
entity references as underlying library XMLBeam does not restrict external
reference expansion. An unauthenticated remote malicious user can supply
specially crafted request parameters against Spring Data's projection-based
request payload binding to access arbitrary files on the system.
References:
https://pivotal.io/security/cve-2018-1259
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 4 months
[Bug 1508123] New: CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1508123
Bug ID: 1508123
Summary: CVE-2016-5003 xmlrpc: Deserialization of untrusted
Java object through <ex:serializable> tag
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abhgupta(a)redhat.com, bmcclain(a)redhat.com,
dbhole(a)redhat.com, dblechte(a)redhat.com,
dwalluck(a)redhat.com, eedri(a)redhat.com,
hhorak(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jorton(a)redhat.com, krzysztof.daniel(a)gmail.com,
kseifried(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, puntogil(a)libero.it,
sbonazzo(a)redhat.com, sherold(a)redhat.com,
sochotni(a)redhat.com, tiwillia(a)redhat.com,
ykaul(a)redhat.com, ylavi(a)redhat.com
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva,
allows remote attackers to execute arbitrary code via a crafted serialized Java
object in an <ex:serializable> element.
References:
http://www.openwall.com/lists/oss-security/2016/07/12/5
https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 4 months
[Bug 1372120] New: CVE-2016-6346 RESTEasy: Abuse of GZIPInterceptor in RESTEasy can lead to denial of service attack
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1372120
Bug ID: 1372120
Summary: CVE-2016-6346 RESTEasy: Abuse of GZIPInterceptor in
RESTEasy can lead to denial of service attack
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: jshepherd(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, aszczucz(a)redhat.com,
bazulay(a)redhat.com, bbaranow(a)redhat.com,
bdawidow(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmcclain(a)redhat.com,
cbillett(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dblechte(a)redhat.com, dosoudil(a)redhat.com,
eedri(a)redhat.com, epp-bugs(a)redhat.com,
etirelli(a)redhat.com, felias(a)redhat.com,
fnasser(a)redhat.com, gklein(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
hfnukal(a)redhat.com, huwang(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jbpapp-maint(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jmatthew(a)redhat.com,
jolee(a)redhat.com, jpallich(a)redhat.com,
jshepherd(a)redhat.com, katello-bugs(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lpetrovi(a)redhat.com,
lsurette(a)redhat.com, mbaluch(a)redhat.com,
mgoldboi(a)redhat.com, mgoldman(a)redhat.com,
miburman(a)redhat.com, michal.skrivanek(a)redhat.com,
mmccune(a)redhat.com, mweiler(a)redhat.com,
mwinkler(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, ohadlevy(a)redhat.com,
oourfali(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pkliczew(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
puntogil(a)libero.it, rcernich(a)redhat.com,
Rhev-m-bugs(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
satellite6-bugs(a)redhat.com, sherold(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, tomckay(a)redhat.com,
tsanders(a)redhat.com, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com, ydary(a)redhat.com,
ykaul(a)redhat.com
It was found that GZIPInterceptor is enabled when not necessarily required in
RESTEasy. An attacker could use this flaw to launch a Denial of Service attack.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 4 months