[Bug 1548291] New: CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unitended exposure of resources [epel-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1548291
Bug ID: 1548291
Summary: CVE-2018-1304 tomcat: Incorrect handling of empty
string URL in security constraints can lead to
unitended exposure of resources [epel-all]
Product: Fedora EPEL
Version: epel7
Component: tomcat
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: ivan.afonichev(a)gmail.com
Reporter: sfowler(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora EPEL. While
only one tracking bug has been filed, please correct all affected versions
at the same time. If you need to fix the versions independent of each
other, you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years
[Bug 1298915] New: fop-2.1 is available
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1298915
Bug ID: 1298915
Summary: fop-2.1 is available
Product: Fedora
Version: rawhide
Component: fop
Keywords: FutureFeature, Triaged
Assignee: r.landmann(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: c.david86(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com, rhbugs(a)n-dimensional.de,
r.landmann(a)redhat.com
Latest upstream release: 2.1
Current version/release in rawhide: 2.0-2.fc24
URL: http://archive.apache.org/dist/xmlgraphics/fop/source/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1418731] New: CVE-2017-2613 jenkins: User creation CSRF using GET by admins (SECURITY-406)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1418731
Bug ID: 1418731
Summary: CVE-2017-2613 jenkins: User creation CSRF using GET by
admins (SECURITY-406)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
When administrators accessed a URL like /user/example via HTTP GET, a user with
the ID example was created if it did not exist. While this user record was only
retained until restart in most cases, administrators' web browsers could be
manipulated to create a large number of user records.
Accessing these URLs now no longer results in a user record getting created,
Jenkins will respond with 404 Not Found if no such user exists. When using the
internal Jenkins user database, new users can be created via Manage Jenkins »
Manage Users. To restore the previous (unsafe) behavior, set the system
property hudson.model.User.allowUserCreationViaUrl to true as described on
Features controlled by system properties.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf1...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1418711] New: CVE-2017-2602 jenkins: Pipeline metadata files not blacklisted in agent-to-master security subsystem (SECURITY-358)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1418711
Bug ID: 1418711
Summary: CVE-2017-2602 jenkins: Pipeline metadata files not
blacklisted in agent-to-master security subsystem
(SECURITY-358)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com, tiwillia(a)redhat.com
The following flaw was found in Jenkins:
The Pipeline suite of plugins stored build metadata in the file program.dat and
the directory workflow/. These were not blacklisted in the agent-to-master
security subsystem and could therefore be written to by malicious agents.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
Upstream patch:
https://github.com/jenkinsci/jenkins/commit/414ff7e30aba66bed18c4ee8a8660...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1524945] New: jenkins-plugin-script-security: Arbitrary file read vulnerability in Script Security Plugin (SECURITY-663 )
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1524945
Bug ID: 1524945
Summary: jenkins-plugin-script-security: Arbitrary file read
vulnerability in Script Security Plugin (SECURITY-663)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Users with the ability to configure sandboxed Groovy and Pipeline scripts,
including those from SCM, are able to use a type coercion feature in Groovy to
create new File objects from strings. This allowed reading arbitrary files on
the Jenkins master file system.
Affected versions: Script Security Plugin up to and including 1.36
External References:
https://jenkins.io/security/advisory/2017-12-11/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1459158] New: CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1459158
Bug ID: 1459158
Summary: CVE-2017-5664 tomcat: Security constrained bypass in
error page mechanism
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aileenc(a)redhat.com, alee(a)redhat.com,
apintea(a)redhat.com, bkundal(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dedgar(a)redhat.com, dimitris(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
felias(a)redhat.com, fgavrilo(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, hhorak(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, joelsmith(a)redhat.com,
jolee(a)redhat.com, jondruse(a)redhat.com,
jorton(a)redhat.com, jshepherd(a)redhat.com,
kconner(a)redhat.com, krzysztof.daniel(a)gmail.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, mbabacek(a)redhat.com,
me(a)coolsvap.net, mizdebsk(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, pgier(a)redhat.com,
pjurak(a)redhat.com, ppalaga(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
rnetuka(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rwagner(a)redhat.com,
spinder(a)redhat.com, sstavrev(a)redhat.com,
tcunning(a)redhat.com, theute(a)redhat.com,
tkirby(a)redhat.com, trick(a)vanstaveren.us,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
The error page mechanism of the Java Servlet Specification requires that, when
an error occurs and an error page is configured for the error that occurred,
the original request and response are forwarded to the error page. This means
that the request is presented to the error page with the original HTTP method.
If the error page is a static file, expected behaviour is to serve content of
the file as if processing a GET request, regardless of the actual HTT method.
Tomcat's Default Servlet did not do this. Depending on the original request
this could lead to unexpected and undesirable results for static error pages
including, if the DefaultServlet is configured to permit writes, the
replacement or removal of the custom error page.
Affects: 7.0.0 to 7.0.77, 8.0.0.RC1 to 8.0.43, 8.5.0 to 8.5.14
Upstream fixes:
Tomcat 7.x:
https://svn.apache.org/viewvc?view=revision&revision=1793471
https://svn.apache.org/viewvc?view=revision&revision=1793491
Tomcat 8.0.x:
https://svn.apache.org/viewvc?view=revision&revision=1793470
https://svn.apache.org/viewvc?view=revision&revision=1793489
Tomcat 8.5.x:
https://svn.apache.org/viewvc?view=revision&revision=1793469
https://svn.apache.org/viewvc?view=revision&revision=1793488
External References:
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1508129] New: CVE-2016-5004 xmlrpc: XSS in Content-Encoding HTTP header of xmlrpc
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Bug ID: 1508129
Summary: CVE-2016-5004 xmlrpc: XSS in Content-Encoding HTTP
header of xmlrpc
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abhgupta(a)redhat.com, bmcclain(a)redhat.com,
dbhole(a)redhat.com, dblechte(a)redhat.com,
dwalluck(a)redhat.com, eedri(a)redhat.com,
hhorak(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jorton(a)redhat.com, krzysztof.daniel(a)gmail.com,
kseifried(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, puntogil(a)libero.it,
sbonazzo(a)redhat.com, sherold(a)redhat.com,
sochotni(a)redhat.com, tiwillia(a)redhat.com,
ykaul(a)redhat.com, ylavi(a)redhat.com
The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache
Archiva allows remote attackers to cause a denial of service (resource
consumption) by decompressing a large file containing zeroes.
References:
http://www.openwall.com/lists/oss-security/2016/07/12/5
https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1444759] New: CVE-2017-3523 mysql-connector-java: Connector/ J unspecified vulnerability (CPU Apr 2017)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1444759
Bug ID: 1444759
Summary: CVE-2017-3523 mysql-connector-java: Connector/J
unspecified vulnerability (CPU Apr 2017)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
avibelli(a)redhat.com, chazlett(a)redhat.com,
coneill(a)redhat.com, databases-maint(a)redhat.com,
gsterlin(a)redhat.com, gvarsami(a)redhat.com,
hhorak(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jbalunas(a)redhat.com, jcoleman(a)redhat.com,
jshepherd(a)redhat.com, kconner(a)redhat.com,
kseifried(a)redhat.com, ldimaggi(a)redhat.com,
mmuzila(a)redhat.com, mschorm(a)redhat.com,
nwallace(a)redhat.com, puntogil(a)libero.it,
rrajasek(a)redhat.com, rwagner(a)redhat.com,
tcunning(a)redhat.com, tiwillia(a)redhat.com,
tjay(a)redhat.com, tkirby(a)redhat.com, xjakub(a)fi.muni.cz
Blocks: 1444415
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent:
Connector/J). Supported versions that are affected are 5.1.40 and eariler.
Difficult to exploit vulnerability allows low privileged attacker with network
access via multiple protocols to compromise MySQL Connectors. While the
vulnerability is in MySQL Connectors, attacks may significantly impact
additional products. Successful attacks of this vulnerability can result in
takeover of MySQL Connectors.
External References:
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.ht...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month