[Bug 1541081] New: CVE-2017-15706 tomcat: Incorrect documentation of CGI Servlet search algorithm may lead to misconfiguration [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1541081
Bug ID: 1541081
Summary: CVE-2017-15706 tomcat: Incorrect documentation of CGI
Servlet search algorithm may lead to misconfiguration
[fedora-all]
Product: Fedora
Version: 27
Component: tomcat
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: ivan.afonichev(a)gmail.com
Reporter: thoger(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1541082] New: CVE-2017-15706 tomcat: Incorrect documentation of CGI Servlet search algorithm may lead to misconfiguration [epel-6]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1541082
Bug ID: 1541082
Summary: CVE-2017-15706 tomcat: Incorrect documentation of CGI
Servlet search algorithm may lead to misconfiguration
[epel-6]
Product: Fedora EPEL
Version: el6
Component: tomcat
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: ivan.afonichev(a)gmail.com
Reporter: thoger(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1538332] CVE-2018-5968 jackson-databind: unsafe deserialization due to incomplete blacklist ( incomplete fix for CVE-2017-7525 and CVE-2017-17485)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1538332
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0118,reported=20180122,sour |0118,reported=20180122,sour
|ce=cve,cvss3=8.1/CVSS:3.0/A |ce=cve,cvss3=8.1/CVSS:3.0/A
|V:N/AC:H/PR:N/UI:N/S:U/C:H/ |V:N/AC:H/PR:N/UI:N/S:U/C:H/
|I:H/A:H,cwe=CWE-502,jdv-6/j |I:H/A:H,cwe=CWE-502,jdv-6/j
|ackson-databind=new,jbds-10 |ackson-databind=new,jbds-10
|/jackson-databind=new,amq-6 |/jackson-databind=wontfix,a
|/jackson-databind=new,bpms- |mq-6/jackson-databind=new,b
|6/jackson-databind=new,jdg- |pms-6/jackson-databind=new,
|7/jackson-databind=new,jbds |jdg-7/jackson-databind=new,
|-8/jackson-databind=new,eap |jbds-8/jackson-databind=won
|-7/jackson-databind=affecte |tfix,eap-7/jackson-databind
|d/impact=moderate/cvss3=8.1 |=affected/impact=moderate/c
|/CVSS:3.0/AV:N/AC:H/PR:N/UI |vss3=8.1/CVSS:3.0/AV:N/AC:H
|:N/S:U/C:H/I:H/A:H,fuse-6/j |/PR:N/UI:N/S:U/C:H/I:H/A:H,
|ackson-databind=new,rhsso-7 |fuse-6/jackson-databind=new
|/jackson-databind=new,sam-1 |,rhsso-7/jackson-databind=n
|/jackson-databind=wontfix,r |ew,sam-1/jackson-databind=w
|hscl-3/rh-eclipse46-jackson |ontfix,rhscl-3/rh-eclipse46
|-databind=new,rhev-m-4/jack |-jackson-databind=new,rhev-
|son-databind=new,fedora-all |m-4/jackson-databind=new,fe
|/jackson-databind=affected, |dora-all/jackson-databind=a
|openshift-1/jackson-databin |ffected,openshift-1/jackson
|d=new,rhscl-3/rh-maven35-ja |-databind=new,rhscl-3/rh-ma
|ckson-databind=new,rhn_sate |ven35-jackson-databind=new,
|llite_6/jackson-databind=wo |rhn_satellite_6/jackson-dat
|ntfix,eap-6/jackson-databin |abind=wontfix,eap-6/jackson
|d=affected/impact=moderate/ |-databind=affected/impact=m
|cvss3=8.1/CVSS:3.0/AV:N/AC: |oderate/cvss3=8.1/CVSS:3.0/
|H/PR:N/UI:N/S:U/C:H/I:H/A:H |AV:N/AC:H/PR:N/UI:N/S:U/C:H
| |/I:H/A:H
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1546596] New: takari-archiver-0.1.19 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1546596
Bug ID: 1546596
Summary: takari-archiver-0.1.19 is available
Product: Fedora
Version: rawhide
Component: takari-archiver
Keywords: FutureFeature, Triaged
Assignee: mizdebsk(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dchen(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
Latest upstream release: 0.1.19
Current version/release in rawhide: 0.1.18-3.fc28
URL: http://takari.io
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/9578/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1532122] New: CVE-2017-17837 Apache DeltaSpike: XSS injection vulnerability in windowId handling
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1532122
Bug ID: 1532122
Summary: CVE-2017-17837 Apache DeltaSpike: XSS injection
vulnerability in windowId handling
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, chazlett(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jolee(a)redhat.com,
jstastny(a)redhat.com, kconner(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
nwallace(a)redhat.com, pavelp(a)redhat.com,
puntogil(a)libero.it, rwagner(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
vhalbert(a)redhat.com
The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId
handling. The default size of the windowId get's cut off after 10 characters
(by default), so the impact might be limited. A fix got applied and released in
Apache deltaspike-1.8.1.
References:
https://nvd.nist.gov/vuln/detail/CVE-2017-17837
https://issues.apache.org/jira/browse/DELTASPIKE-1307
https://git-wip-us.apache.org/repos/asf?p=deltaspike.git;h=4e25023
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1538332] CVE-2018-5968 jackson-databind: unsafe deserialization due to incomplete blacklist ( incomplete fix for CVE-2017-7525 and CVE-2017-17485)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1538332
--- Comment #11 from Doran Moppert <dmoppert(a)redhat.com> ---
Statement:
JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling
and unmarshalling of JSON objects passed to JAX-RS webservices. Some advice
about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is
available here:
https://access.redhat.com/solutions/3279231
This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1)
and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as
shipped with Red Hat Satellitw 6.x. However the affected code is NOT used at
this time:
Candlepin currently uses the default type resolution configuration for the
ObjectMappers it creates/uses. Nowhere in candlepin do we enable global
polymorphic deserialization via enableDefaultTyping(...), therefore based on
the documentation sited BZ 1462702 , candlepin should not be affected.
However as the vulnerable software ships with the product we have marked them
as vulnerable to ensure the issue is tracked.
Red Hat Subscription Asset Manager version 1 is now in a reduced support phase
receiving only Critical impact security fixes. This issue has been rated as
having Important security impact and is not currently planned to be addressed
in future updates.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1540001] New: CVE-2018-1294 apache-commons-email: Improper validation in Email.setBounceAddress() can allow for email modification [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1540001
Bug ID: 1540001
Summary: CVE-2018-1294 apache-commons-email: Improper
validation in Email.setBounceAddress() can allow for
email modification [fedora-all]
Product: Fedora
Version: 27
Component: apache-commons-email
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: SpikeFedora(a)gmail.com
Reporter: sfowler(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months