[Bug 1549276] CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1549276
Tomas Hoger <thoger(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mat.booth(a)redhat.com
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0226,reported=20180226,sour |0226,reported=20180226,sour
|ce=cve,cvss3=8.1/CVSS:3.0/A |ce=cve,cvss3=8.1/CVSS:3.0/A
|V:N/AC:H/PR:N/UI:N/S:U/C:H/ |V:N/AC:H/PR:N/UI:N/S:U/C:H/
|I:H/A:H,cwe=CWE-20,amq-6/ja |I:H/A:H,cwe=CWE-20,amq-6/ja
|ckson-databind=wontfix,jdg- |ckson-databind=wontfix,jdg-
|7/jackson-databind=notaffec |7/jackson-databind=notaffec
|ted,jdv-6/jackson-databind= |ted,jdv-6/jackson-databind=
|wontfix,eap-7/jackson-datab |wontfix,eap-7/jackson-datab
|ind=affected,bpms-6/jackson |ind=affected,bpms-6/jackson
|-databind=affected,brms-6/j |-databind=affected,brms-6/j
|ackson-databind=affected,fu |ackson-databind=affected,fu
|se-6/jackson-databind=wontf |se-6/jackson-databind=wontf
|ix,openshift-enterprise-2/j |ix,openshift-enterprise-2/j
|ackson-databind=new,rhn_sat |ackson-databind=new,rhn_sat
|ellite_6/jackson-databind=n |ellite_6/jackson-databind=n
|otaffected/impact=low,rhmap |otaffected/impact=low,rhmap
|-4/jackson-databind=notaffe |-4/jackson-databind=notaffe
|cted,sam-1/jackson-databind |cted,sam-1/jackson-databind
|=wontfix,rhev-m-4/eap7-jack |=wontfix,rhev-m-4/eap7-jack
|son-databind=affected,rhscl |son-databind=affected,rhscl
|-3/rh-eclipse46-jackson-dat |-3/rh-eclipse46-jackson-dat
|abind=affected,fedora-all/j |abind=wontfix,fedora-all/ja
|ackson-databind=affected,jo |ckson-databind=affected,jon
|n-3/Core |-3/Core
|Server=new,eap-6/jackson-da |Server=new,eap-6/jackson-da
|tabind=affected,rhscl-3/rh- |tabind=affected,rhscl-3/rh-
|maven35-jackson-databind=af |maven35-jackson-databind=af
|fected,vertx-3/jackson-data |fected,vertx-3/jackson-data
|bind=affected,swarm-7/jacks |bind=affected,swarm-7/jacks
|on-databind=affected,fis-2/ |on-databind=affected,fis-2/
|jackson-databind=affected,f |jackson-databind=affected,f
|use-7/Camel=affected |use-7/Camel=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 3 months
[Bug 1538332] CVE-2018-5968 jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1538332
Tomas Hoger <thoger(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |mat.booth(a)redhat.com
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0118,reported=20180122,sour |0118,reported=20180122,sour
|ce=cve,cvss3=8.1/CVSS:3.0/A |ce=cve,cvss3=8.1/CVSS:3.0/A
|V:N/AC:H/PR:N/UI:N/S:U/C:H/ |V:N/AC:H/PR:N/UI:N/S:U/C:H/
|I:H/A:H,cwe=CWE-502,jdv-6/j |I:H/A:H,cwe=CWE-502,jdv-6/j
|ackson-databind=wontfix,jbd |ackson-databind=wontfix,jbd
|s-10/jackson-databind=wontf |s-10/jackson-databind=wontf
|ix,amq-6/jackson-databind=n |ix,amq-6/jackson-databind=n
|otaffected,bpms-6/jackson-d |otaffected,bpms-6/jackson-d
|atabind=affected,jdg-7/jack |atabind=affected,jdg-7/jack
|son-databind=notaffected,jb |son-databind=notaffected,jb
|ds-8/jackson-databind=wontf |ds-8/jackson-databind=wontf
|ix,eap-7/jackson-databind=a |ix,eap-7/jackson-databind=a
|ffected/impact=moderate/cvs |ffected/impact=moderate/cvs
|s3=8.1/CVSS:3.0/AV:N/AC:H/P |s3=8.1/CVSS:3.0/AV:N/AC:H/P
|R:N/UI:N/S:U/C:H/I:H/A:H,fu |R:N/UI:N/S:U/C:H/I:H/A:H,fu
|se-6/jackson-databind=notaf |se-6/jackson-databind=notaf
|fected,rhsso-7/jackson-data |fected,rhsso-7/jackson-data
|bind=affected,sam-1/jackson |bind=affected,sam-1/jackson
|-databind=wontfix,rhscl-3/r |-databind=wontfix,rhscl-3/r
|h-eclipse46-jackson-databin |h-eclipse46-jackson-databin
|d=affected,rhev-m-4/jackson |d=wontfix,rhev-m-4/jackson-
|-databind=affected,fedora-a |databind=affected,fedora-al
|ll/jackson-databind=affecte |l/jackson-databind=affected
|d,openshift-1/jackson-datab |,openshift-1/jackson-databi
|ind=affected,rhscl-3/rh-mav |nd=affected,rhscl-3/rh-mave
|en35-jackson-databind=affec |n35-jackson-databind=affect
|ted,rhn_satellite_6/jackson |ed,rhn_satellite_6/jackson-
|-databind=wontfix,eap-6/jac |databind=wontfix,eap-6/jack
|kson-databind=affected/impa |son-databind=affected/impac
|ct=moderate/cvss3=8.1/CVSS: |t=moderate/cvss3=8.1/CVSS:3
|3.0/AV:N/AC:H/PR:N/UI:N/S:U |.0/AV:N/AC:H/PR:N/UI:N/S:U/
|/C:H/I:H/A:H |C:H/I:H/A:H
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 3 months
[Bug 1660117] New: apache-commons-logging: Please rebuild to drop javapackages-tools dependency
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1660117
Bug ID: 1660117
Summary: apache-commons-logging: Please rebuild to drop
javapackages-tools dependency
Product: Fedora
Version: 29
Status: NEW
Component: apache-commons-logging
Assignee: mizdebsk(a)redhat.com
Reporter: fweimer(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, mizdebsk(a)redhat.com,
sochotni(a)redhat.com, SpikeFedora(a)gmail.com
Target Milestone: ---
Classification: Fedora
apache-commons-logging-1.2-14.fc29.noarch depends on javapackages-tools, which
pools in OpenJDK 8 indirectly. A rebuild will change that and switch to the
javapackages-filesystem dependency, avoiding the potentially wasteful
installation of OpenJDK 8.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 3 months
[Bug 1604756] lucene3: FTBFS in Fedora rawhide
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1604756
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Fixed In Version| |lucene3-3.6.2-15.fc29
Resolution|--- |ERRATA
Last Closed| |2018-12-18 03:05:20
--- Comment #5 from Fedora Update System <updates(a)fedoraproject.org> ---
lucene3-3.6.2-15.fc29 has been pushed to the Fedora 29 stable repository. If
problems still persist, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 3 months
[Bug 1602975] jetty-9.4.12.RC1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1602975
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|MODIFIED |CLOSED
Fixed In Version| |jetty-9.4.14-1.v20181114.fc
| |29
Resolution|--- |ERRATA
Last Closed| |2018-12-16 04:22:14
--- Comment #5 from Fedora Update System <updates(a)fedoraproject.org> ---
ecj-4.10-1.fc29, eclipse-4.10.0-1.fc29, eclipse-abrt-0.0.3-7.fc29,
eclipse-dtp-1.14.102-2.fc29, eclipse-ecf-3.14.4-1.fc29,
eclipse-emf-2.16.0-1.fc29, eclipse-epp-logging-2.0.7-5.fc29,
eclipse-launchbar-2.2.2-1.fc29, eclipse-linuxtools-7.1.0-1.fc29,
eclipse-m2e-core-1.10.0-1.fc29, eclipse-m2e-wtp-1.4.1-1.fc29,
eclipse-mpc-1.7.3-1.fc29, eclipse-pdt-6.2.0-1.fc29,
eclipse-photran-9.2.1-1.fc29, eclipse-ptp-9.2.1-1.fc29,
eclipse-testng-6.14.0-6.fc29, glassfish-jaxb-api-2.2.12-10.fc29,
icu4j-63.1-1.fc29, jetty-9.4.14-1.v20181114.fc29, jnr-constants-0.9.12-1.fc29,
jnr-enxio-0.19-1.fc29, jnr-ffi-2.1.8-1.fc29, jnr-posix-3.0.47-1.fc29,
jnr-unixsocket-0.21-1.fc29 has been pushed to the Fedora 29 stable repository.
If problems still persist, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 3 months