[Bug 1652028] New: CVE-2018-19209 nasm: NULL pointer dereference in find_label in asm/labels.c [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1652028
Bug ID: 1652028
Summary: CVE-2018-19209 nasm: NULL pointer dereference in
find_label in asm/labels.c [fedora-all]
Product: Fedora
Version: 29
Component: nasm
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: mizdebsk(a)redhat.com
Reporter: lpardo(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dominik(a)greysector.net,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 5 months
[Bug 1651837] New: CVE-2018-17187 qpid-proton-java: Hostname verification mode not implemented in transport TLS wrapper
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1651837
Bug ID: 1651837
Summary: CVE-2018-17187 qpid-proton-java: Hostname verification
mode not implemented in transport TLS wrapper
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, avibelli(a)redhat.com,
bgeorges(a)redhat.com, chazlett(a)redhat.com,
esammons(a)redhat.com, hghasemb(a)redhat.com,
iboverma(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jbalunas(a)redhat.com, jpallich(a)redhat.com,
jross(a)redhat.com, jshepherd(a)redhat.com,
krathod(a)redhat.com, lthon(a)redhat.com,
mcressma(a)redhat.com, mszynkie(a)redhat.com,
pgallagh(a)redhat.com, puntogil(a)libero.it,
rrajasek(a)redhat.com, rruss(a)redhat.com,
trogers(a)redhat.com
The Proton-J transport includes an optional wrapper layer to perform TLS,
enabled by use of the 'transport.ssl(...)' methods. Unless a verification mode
was explicitly configured, client and server modes previously defaulted as
documented to not verifying a peer certificate, with options to configure this
explicitly or select a certificate verification mode with or without hostname
verification being performed.
The latter hostname verifying mode was not previously implemented, with
attempts to use it resulting in an exception. This left only the option to
verify the certificate is trusted, leaving such a client vulnerable to Man In
The Middle (MITM) attack.
Uses of the Proton-J protocol engine which do not utilise the optional
transport TLS wrapper are not impacted, e.g. usage within Qpid JMS.
External References:
https://qpid.apache.org/cves/CVE-2018-17187.html
https://mail-archives.apache.org/mod_mbox/qpid-users/201811.mbox/%3CCAFit...
Upstream Bug:
https://issues.apache.org/jira/browse/PROTON-1962
Upstream Patch:
https://git-wip-us.apache.org/repos/asf?p=qpid-proton-j.git;h=0cb8ca0
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 5 months
[Bug 1651838] New: CVE-2018-17187 qpid-proton-java: Hostname verification mode not implemented in transport TLS wrapper [ fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1651838
Bug ID: 1651838
Summary: CVE-2018-17187 qpid-proton-java: Hostname verification
mode not implemented in transport TLS wrapper
[fedora-all]
Product: Fedora
Version: 29
Component: qpid-proton-java
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: puntogil(a)libero.it
Reporter: sfowler(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: iboverma(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 5 months
[Bug 1618573] CVE-2018-11771 apache-commons-compress: ZipArchiveInputStream.read() fails to identify correct EOF allowing for DoS via crafted zip
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1618573
Doran Moppert <dmoppert(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0817,reported=20180816,sour |0817,reported=20180816,sour
|ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:R/S:U |3.0/AV:N/AC:L/PR:N/UI:R/S:U
|/C:N/I:N/A:L,cwe=CWE-400,fe |/C:N/I:N/A:L,cwe=CWE-400,fe
|dora-all/apache-commons-com |dora-all/apache-commons-com
|press=affected,rhel-8/apach |press=affected,rhel-8/apach
|e-commons-compress=affected |e-commons-compress=affected
|,rhel-7/apache-commons-comp |,rhel-7/apache-commons-comp
|ress=notaffected,rhev-m-4/a |ress=notaffected,rhev-m-4/a
|pache-commons-compress=nota |pache-commons-compress=nota
|ffected,rhscl-3/rh-java-com |ffected,rhscl-3/rh-java-com
|mon-apache-commons-compress |mon-apache-commons-compress
|=new,rhscl-3/rh-maven35-apa |=notaffected,rhscl-3/rh-mav
|che-commons-compress=new,rh |en35-apache-commons-compres
|map-4/commons-compress=new, |s=affected,rhmap-4/commons-
|rhes-3/commons-compress=won |compress=new,rhes-3/commons
|tfix/impact=low,fsw-6/commo |-compress=wontfix/impact=lo
|ns-compress=new,fuse-6/comm |w,fsw-6/commons-compress=ne
|ons-compress=new,fuse-7/com |w,fuse-6/commons-compress=n
|mons-compress=new,jbds-11/c |ew,fuse-7/commons-compress=
|ommons-compress=new,jdv-6/c |new,jbds-11/commons-compres
|ommons-compress=new,bpms-6/ |s=new,jdv-6/commons-compres
|commons-compress=new,brms-6 |s=new,bpms-6/commons-compre
|/commons-compress=new,jon-3 |ss=new,brms-6/commons-compr
|/commons-compress=new,opens |ess=new,jon-3/commons-compr
|tack-8/opendaylight=wontfix |ess=new,openstack-8/openday
|,openstack-9/opendaylight=w |light=wontfix,openstack-9/o
|ontfix,rhn_satellite_6/comm |pendaylight=wontfix,rhn_sat
|ons-compress=new |ellite_6/commons-compress=n
| |ew
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 5 months
[Bug 1618573] CVE-2018-11771 apache-commons-compress: ZipArchiveInputStream.read() fails to identify correct EOF allowing for DoS via crafted zip
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1618573
Doran Moppert <dmoppert(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0817,reported=20180816,sour |0817,reported=20180816,sour
|ce=internet,cvss3=4.3/CVSS: |ce=internet,cvss3=4.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:R/S:U |3.0/AV:N/AC:L/PR:N/UI:R/S:U
|/C:N/I:N/A:L,cwe=CWE-400,fe |/C:N/I:N/A:L,cwe=CWE-400,fe
|dora-all/apache-commons-com |dora-all/apache-commons-com
|press=affected,rhel-8/apach |press=affected,rhel-8/apach
|e-commons-compress=affected |e-commons-compress=affected
|,rhel-7/apache-commons-comp |,rhel-7/apache-commons-comp
|ress=new,rhev-m-4/apache-co |ress=notaffected,rhev-m-4/a
|mmons-compress=new,rhscl-3/ |pache-commons-compress=nota
|rh-java-common-apache-commo |ffected,rhscl-3/rh-java-com
|ns-compress=new,rhscl-3/rh- |mon-apache-commons-compress
|maven35-apache-commons-comp |=new,rhscl-3/rh-maven35-apa
|ress=new,rhmap-4/commons-co |che-commons-compress=new,rh
|mpress=new,rhes-3/commons-c |map-4/commons-compress=new,
|ompress=wontfix/impact=low, |rhes-3/commons-compress=won
|fsw-6/commons-compress=new, |tfix/impact=low,fsw-6/commo
|fuse-6/commons-compress=new |ns-compress=new,fuse-6/comm
|,fuse-7/commons-compress=ne |ons-compress=new,fuse-7/com
|w,jbds-11/commons-compress= |mons-compress=new,jbds-11/c
|new,jdv-6/commons-compress= |ommons-compress=new,jdv-6/c
|new,bpms-6/commons-compress |ommons-compress=new,bpms-6/
|=new,brms-6/commons-compres |commons-compress=new,brms-6
|s=new,jon-3/commons-compres |/commons-compress=new,jon-3
|s=new,openstack-8/opendayli |/commons-compress=new,opens
|ght=wontfix,openstack-9/ope |tack-8/opendaylight=wontfix
|ndaylight=wontfix,rhn_satel |,openstack-9/opendaylight=w
|lite_6/commons-compress=new |ontfix,rhn_satellite_6/comm
| |ons-compress=new
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 5 months
[Bug 1651223] New: Hibernation not working, how to enable it?
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1651223
Bug ID: 1651223
Summary: Hibernation not working, how to enable it?
Product: Fedora
Version: 29
Component: hibernate
Severity: urgent
Assignee: puntogil(a)libero.it
Reporter: xzj8b3(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
Created attachment 1507222
--> https://bugzilla.redhat.com/attachment.cgi?id=1507222&action=edit
SSD partitioning
It would have made me comfortable using hibernation, but perhaps partitioning
manually SSD I have perhaps wrong something
I would like to politely know how to be configured correctly to be enabled, the
notebook has 8 gb of ram and I attach screen of how it was partitioned in ext4
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 5 months
[Bug 1629083] New: CVE-2018-11775 activemq: ActiveMQ Client Missing TLS Hostname Verification
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1629083
Bug ID: 1629083
Summary: CVE-2018-11775 activemq: ActiveMQ Client Missing TLS
Hostname Verification
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: agrimm(a)gmail.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, anstephe(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
bmcclain(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dblechte(a)redhat.com,
dfediuck(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eedri(a)redhat.com, etirelli(a)redhat.com,
gvarsami(a)redhat.com, hghasemb(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jshepherd(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lpetrovi(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
psotirop(a)redhat.com, pszubiak(a)redhat.com,
puntogil(a)libero.it, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sbonazzo(a)redhat.com,
sdaley(a)redhat.com, sherold(a)redhat.com, s(a)shk.io,
sthorger(a)redhat.com, tcunning(a)redhat.com,
tdawson(a)redhat.com, tkirby(a)redhat.com,
twalsh(a)redhat.com, vtunka(a)redhat.com, ylavi(a)redhat.com
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6
was missing which could make the client vulnerable to a MITM attack between a
Java application using the ActiveMQ client and the ActiveMQ server. This is now
enabled by default.
References:
http://activemq.apache.org/security-advisories.data/CVE-2018-11775-announ...
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 5 months
[Bug 1650958] New: jogl2-2.3.2-8.fc29.x86_64 cause scilab's plot error.
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1650958
Bug ID: 1650958
Summary: jogl2-2.3.2-8.fc29.x86_64 cause scilab's plot error.
Product: Fedora
Version: 29
Component: jogl2
Severity: medium
Assignee: c.david86(a)gmail.com
Reporter: lenin(a)hasiru.net
QA Contact: extras-qa(a)fedoraproject.org
CC: c.david86(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org
Description of problem:
scilab
plot function not work.
on AMD radeon GPU.(On Itel and NVIDIA GPU works fine)
Because error
Caught GLException: Profile GL3bc is not available on X11GraphicsDevice
Version-Release number of selected component (if applicable):
jogl2-2.3.2-8.fc29.x86_64
How reproducible:
Always
Steps to Reproduce:
1.run scilab on terminal
2.x=-2:0.1:2;
3.y=2*x^3-x^2-3*x;
4.plot(x,y)
Actual results:
error
Caught GLException: Profile GL3bc is not available on X11GraphicsDevice
Expected results:
plot graph.
Additional info:
I force rollback version
jogl2-2.3.2-8.fc29.x86_64
to
jogl2-2.3.2-6.fc28.x86_64
And it works fine.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 5 months