[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1528565
Mark Knowles <mknowles(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71212,reported=20171206,sou |71212,reported=20171206,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,eap-6/reste |S:U/C:H/I:H/A:H,eap-6/reste
|asy=affected,fedora-all/jac |asy=affected,fedora-all/jac
|kson-databind=affected,jdg- |kson-databind=affected,jdg-
|7/jackson-databind=new,jon- |7/jackson-databind=new,jon-
|3/resteasy=notaffected,open |3/resteasy=notaffected,open
|shift-enterprise-2/jackson- |shift-enterprise-2/jackson-
|databind=new,dts-4/devtools |databind=affected,dts-4/dev
|et-4-jackson-databind=wontf |toolset-4-jackson-databind=
|ix,rhev-m-3/jasperreports-s |wontfix,rhev-m-3/jasperrepo
|erver-pro=wontfix,rhev-m-4/ |rts-server-pro=wontfix,rhev
|eap7-jackson-databind=affec |-m-4/eap7-jackson-databind=
|ted,amq-6/jackson-databind= |affected,amq-6/jackson-data
|notaffected,bpms-6/jackson- |bind=notaffected,bpms-6/jac
|databind=notaffected,jdv-6/ |kson-databind=notaffected,j
|jackson-databind=notaffecte |dv-6/jackson-databind=notaf
|d,fuse-6/jackson-databind=n |fected,fuse-6/jackson-datab
|otaffected,rhmap-4/jackson- |ind=notaffected,rhmap-4/jac
|databind=notaffected,rhn_sa |kson-databind=notaffected,r
|tellite_6/jackson-databind= |hn_satellite_6/jackson-data
|new,rhscl-3/rh-eclipse46-ja |bind=new,rhscl-3/rh-eclipse
|ckson-databind=affected,rhs |46-jackson-databind=affecte
|cl-3/rh-maven35-jackson-dat |d,rhscl-3/rh-maven35-jackso
|abind=affected,sam-1/jackso |n-databind=affected,sam-1/j
|n-databind=wontfix,eap-7/re |ackson-databind=wontfix,eap
|steasy=affected,brms-6/jack |-7/resteasy=affected,brms-6
|son-databind=notaffected |/jackson-databind=notaffect
| |ed
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1508110] CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1508110
Mark Knowles <mknowles(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
|0524,reported=20160524,sour |0524,reported=20160524,sour
|ce=cve,cvss3=6.4/CVSS:3.0/A |ce=cve,cvss3=6.4/CVSS:3.0/A
|V:N/AC:L/PR:L/UI:N/S:C/C:L/ |V:N/AC:L/PR:L/UI:N/S:C/C:L/
|I:L/A:N,cwe=CWE-352,fedora- |I:L/A:N,cwe=CWE-352,fedora-
|all/xmlrpc=affected,rhel-5/ |all/xmlrpc=affected,rhel-5/
|xmlrpc=wontfix,rhel-6/xmlrp |xmlrpc=wontfix,rhel-6/xmlrp
|c3=wontfix,rhel-7/xmlrpc=wo |c3=wontfix,rhel-7/xmlrpc=wo
|ntfix,rhev-m-3/xmlrpc-commo |ntfix,rhev-m-3/xmlrpc-commo
|n=wontfix,rhscl-3/rh-java-c |n=wontfix,rhscl-3/rh-java-c
|ommon-xmlrpc=affected,rhes- |ommon-xmlrpc=affected,rhes-
|3/xmlrpc-common=wontfix,jbd |3/xmlrpc-common=wontfix,jbd
|s-8/xmlrpc=new,jbds-10/xmlr |s-8/xmlrpc=new,jbds-10/xmlr
|pc=new,fuse-6/camel-xmlrpc= |pc=new,fuse-6/camel-xmlrpc=
|new,openshift-enterprise-3/ |new,openshift-enterprise-3/
|xmlrpc-common=new |xmlrpc-common=notaffected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1549276] CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1549276
Pedro Sampaio <psampaio(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |abhgupta(a)redhat.com,
| |alazarot(a)redhat.com,
| |anstephe(a)redhat.com,
| |apintea(a)redhat.com,
| |avibelli(a)redhat.com,
| |bcourt(a)redhat.com,
| |bgeorges(a)redhat.com,
| |bkearney(a)redhat.com,
| |bkundal(a)redhat.com,
| |bmaxwell(a)redhat.com,
| |bmcclain(a)redhat.com,
| |cbillett(a)redhat.com,
| |cdewolf(a)redhat.com,
| |cmoulliard(a)redhat.com,
| |csutherl(a)redhat.com,
| |darran.lofthouse(a)redhat.com
| |, dblechte(a)redhat.com,
| |dffrench(a)redhat.com,
| |dimitris(a)redhat.com,
| |dosoudil(a)redhat.com,
| |drieden(a)redhat.com,
| |drusso(a)redhat.com,
| |eedri(a)redhat.com,
| |etirelli(a)redhat.com,
| |fgavrilo(a)redhat.com,
| |gklein(a)redhat.com,
| |hhorak(a)redhat.com,
| |ibek(a)redhat.com,
| |java-sig-commits(a)lists.fedo
| |raproject.org,
| |jawilson(a)redhat.com,
| |jbalunas(a)redhat.com,
| |jmadigan(a)redhat.com,
| |jmatthew(a)redhat.com,
| |jolee(a)redhat.com,
| |jondruse(a)redhat.com,
| |jorton(a)redhat.com,
| |jpallich(a)redhat.com,
| |jschatte(a)redhat.com,
| |jshepherd(a)redhat.com,
| |jstastny(a)redhat.com,
| |kseifried(a)redhat.com,
| |kverlaen(a)redhat.com,
| |lef(a)fedoraproject.org,
| |lgao(a)redhat.com,
| |lgriffin(a)redhat.com,
| |loleary(a)redhat.com,
| |lpetrovi(a)redhat.com,
| |lsurette(a)redhat.com,
| |lthon(a)redhat.com,
| |mat.booth(a)redhat.com,
| |mgoldboi(a)redhat.com,
| |miburman(a)redhat.com,
| |michal.skrivanek(a)redhat.com
| |, mmccune(a)redhat.com,
| |mrike(a)redhat.com,
| |mszynkie(a)redhat.com,
| |myarboro(a)redhat.com,
| |ngough(a)redhat.com,
| |ohadlevy(a)redhat.com,
| |paradhya(a)redhat.com,
| |pavelp(a)redhat.com,
| |pgallagh(a)redhat.com,
| |pgier(a)redhat.com,
| |pjurak(a)redhat.com,
| |ppalaga(a)redhat.com,
| |psakar(a)redhat.com,
| |pslavice(a)redhat.com,
| |psotirop(a)redhat.com,
| |pszubiak(a)redhat.com,
| |puntogil(a)libero.it,
| |pwright(a)redhat.com,
| |rbalakri(a)redhat.com,
| |rchan(a)redhat.com,
| |Rhev-m-bugs(a)redhat.com,
| |rnetuka(a)redhat.com,
| |rrajasek(a)redhat.com,
| |rruss(a)redhat.com,
| |rstancel(a)redhat.com,
| |rsvoboda(a)redhat.com,
| |rsynek(a)redhat.com,
| |rzhang(a)redhat.com,
| |sdaley(a)redhat.com,
| |sherold(a)redhat.com,
| |spinder(a)redhat.com,
| |srevivo(a)redhat.com,
| |sstavrev(a)redhat.com,
| |theute(a)redhat.com,
| |tiwillia(a)redhat.com,
| |tjay(a)redhat.com,
| |tomckay(a)redhat.com,
| |trepel(a)redhat.com,
| |trogers(a)redhat.com,
| |tsanders(a)redhat.com,
| |twalsh(a)redhat.com,
| |vhalbert(a)redhat.com,
| |vtunka(a)redhat.com,
| |ykaul(a)redhat.com,
| |ylavi(a)redhat.com
Whiteboard|impact=important,public=201 |impact=important,public=201
|80226,reported=20180226,sou |80226,reported=20180226,sou
|rce=cve,cvss3=8.1/CVSS:3.0/ |rce=cve,cvss3=8.1/CVSS:3.0/
|AV:N/AC:H/PR:N/UI:N/S:U/C:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H
|/I:H/A:H,cwe=CWE-20,amq-6/j |/I:H/A:H,cwe=CWE-20,amq-6/j
|ackson-databind=new |ackson-databind=new,jdg-7/j
| |ackson-databind=new,jdv-6/j
| |ackson-databind=new,eap-7/j
| |ackson-databind=new,bpms-6/
| |jackson-databind=new,brms-6
| |/jackson-databind=new,fuse-
| |6/jackson-databind=new,open
| |shift-enterprise-2/jackson-
| |databind=new,rhn_satellite_
| |6/jackson-databind=new/impa
| |ct=low,rhmap-4/jackson-data
| |bind=new,sam-1/jackson-data
| |bind=new,rhev-m-3/jasperrep
| |orts-server-pro=new,rhev-m-
| |4/eap7-jackson-databind=new
| |,rhscl-2/rh-eclipse46-jacks
| |on-databind=new,fedora-all/
| |jackson-databind=affected,j
| |on-3/Core
| |Server=new,eap-6/jackson-da
| |tabind=new,dts-4/devtoolset
| |-4-jackson-databind=new,rhs
| |cl-3/rh-maven35-jackson-dat
| |abind=new,vertx-3/jackson-d
| |atabind=new,swarm-7/jackson
| |-databind=new
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1541996] New: CVE-2018-1199 Spring Security: Security bypass with static resources
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1541996
Bug ID: 1541996
Summary: CVE-2018-1199 Spring Security: Security bypass with
static resources
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Spring Security does not consider URL path parameters when processing security
constraints. By adding a URL path parameter with special encodings, an attacker
may be able to bypass a security constraint. The root cause of this issue is a
lack of clarity regarding the handling of path parameters in the Servlet
Specification (see below). Some Servlet containers include path parameters in
the value returned for getPathInfo() and some do not. Spring Security uses the
value returned by getPathInfo() as part of the process of mapping requests to
security constraints. In this particular attack, different character encodings
used in path parameters allows secured Spring MVC static resource URLs to be
bypassed.
External References:
https://pivotal.io/security/cve-2018-1199
Mitigation:
As a general precaution, users are encouraged to separate public and private
resources. For example, separating static resources and mapping them to
/resources/public/** and /resources/private/** is preferred to having one
common root with mixed public and private resource content underneath.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1547501] New: FTBFS: Could not resolve dependencies for project org.codehaus.mojo: castor-maven-plugin:maven-plugin:2.5:
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1547501
Bug ID: 1547501
Summary: FTBFS: Could not resolve dependencies for project
org.codehaus.mojo:castor-maven-plugin:maven-plugin:2.5
:
Product: Fedora
Version: 28
Component: castor-maven-plugin
Severity: high
Priority: high
Assignee: mat.booth(a)redhat.com
Reporter: karsten(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com
Description of problem:
castor-maven-plugin fails to build in F28 (and rawhide):
Executing: xmvn --batch-mode --offline -Denforcer.skip=true verify
org.fedoraproject.xmvn:xmvn-mojo:install
org.apache.maven.plugins:maven-javadoc-plugin:aggregate
org.fedoraproject.xmvn:xmvn-mojo:builddep
['xmvn', '--batch-mode', '--offline', '-Denforcer.skip=true', 'verify',
'org.fedoraproject.xmvn:xmvn-mojo:install',
'org.apache.maven.plugins:maven-javadoc-plugin:aggregate',
'org.fedoraproject.xmvn:xmvn-mojo:builddep']
[INFO] Scanning for projects...
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Building Castor Maven Plugin 2.5
[INFO] ------------------------------------------------------------------------
[WARNING] The POM for org.apache.maven:maven-project:jar:2.0 is missing, no
dependency information available
[INFO]
[INFO] ------------------------------------------------------------------------
[INFO] Skipping Castor Maven Plugin
[INFO] This project has been banned from the build due to previous failures.
[INFO] ------------------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 1.389 s
[INFO] Finished at: 2018-02-21T12:54:14Z
[INFO] Final Memory: 11M/114M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal on project castor-maven-plugin: Could not
resolve dependencies for project
org.codehaus.mojo:castor-maven-plugin:maven-plugin:2.5: Cannot access central
(https://repo.maven.apache.org/maven2) in offline mode and the artifact
org.apache.maven:maven-project:jar:2.0 has not been downloaded from it before.
-> [Help 1]
[ERROR]
Version-Release number of selected component (if applicable):
castor-maven-plugin-2.5-6
How reproducible:
always
Steps to Reproduce:
1. koji build --scratch f28 castor-maven-plugin-2.5-6.fc28.rpm
2.
3.
Actual results:
https://koji.fedoraproject.org/koji/taskinfo?taskID=25209749
Expected results:
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months