[Bug 1520471] New: CVE-2017-14949 restlet: XXE vulnerability in XML extension allows remote attackers to access arbitrary files via a crafted REST API HTTP request
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1520471
Bug ID: 1520471
Summary: CVE-2017-14949 restlet: XXE vulnerability in XML
extension allows remote attackers to access arbitrary
files via a crafted REST API HTTP request
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aileenc(a)redhat.com, chazlett(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, kconner(a)redhat.com,
ldimaggi(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, puntogil(a)libero.it,
rwagner(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com
Restlet Framework before 2.3.12 allows remote attackers to access arbitrary
files via a crafted REST API HTTP request that conducts an XXE attack, because
only general external entities (not parameter external entities) are properly
considered. This is related to XmlRepresentation, DOMRepresentation,
SaxRepresentation, and JacksonRepresentation.
External References:
https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhan...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1510332] CVE-2017-14941 jasperreports: Cleartext storage of passwords
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1510332
Martin Prpič <mprpic(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0930,reported=20171030,sour |0930,reported=20171031,sour
|ce=cve,cvss3=6.5/CVSS:3.0/A |ce=cve,cvss3=6.5/CVSS:3.0/A
|V:N/AC:L/PR:L/UI:N/S:U/C:H/ |V:N/AC:L/PR:L/UI:N/S:U/C:H/
|I:N/A:N,cwe=CWE-312,rhev-m- |I:N/A:N,cwe=CWE-312,rhev-m-
|3/jasperreports-server-pro= |3/jasperreports-server-pro=
|new,fedora-all/jasperreport |new,fedora-all/jasperreport
|s=notaffected |s=notaffected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1506612] CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-7525)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1506612
Martin Prpič <mprpic(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71102,reported=20171008,sou |71102,reported=20171014,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,cwe=CWE-184 |S:U/C:H/I:H/A:H,cwe=CWE-184
|,fedora-all/jackson-databin |,fedora-all/jackson-databin
|d=affected,amq-6/jackson-da |d=affected,amq-6/jackson-da
|tabind=notaffected,jdg-7/ja |tabind=notaffected,jdg-7/ja
|ckson-databind=notaffected, |ckson-databind=notaffected,
|jdv-6/jackson-databind=affe |jdv-6/jackson-databind=affe
|cted,eap-7/jackson-databind |cted,eap-7/jackson-databind
|=affected,bpms-6/jackson-da |=affected,bpms-6/jackson-da
|tabind=affected,brms-6/jack |tabind=affected,brms-6/jack
|son-databind=affected,fuse- |son-databind=affected,fuse-
|6/jackson-databind=notaffec |6/jackson-databind=notaffec
|ted,openshift-enterprise-2/ |ted,openshift-enterprise-2/
|jackson-databind=notaffecte |jackson-databind=notaffecte
|d,rhn_satellite_6/jackson-d |d,rhn_satellite_6/jackson-d
|atabind=affected/impact=low |atabind=affected/impact=low
|,rhmap-4/jackson-databind=n |,rhmap-4/jackson-databind=n
|otaffected,sam-1/jackson-da |otaffected,sam-1/jackson-da
|tabind=wontfix,rhev-m-3/jas |tabind=wontfix,rhev-m-3/jas
|perreports-server-pro=wontf |perreports-server-pro=wontf
|ix/impact=moderate,rhev-m-4 |ix/impact=moderate,rhev-m-4
|/eap7-jackson-databind=affe |/eap7-jackson-databind=affe
|cted/impact=moderate,rhscl- |cted/impact=moderate,rhscl-
|3/rh-eclipse46-jackson-data |3/rh-eclipse46-jackson-data
|bind=affected,jon-3/Core |bind=affected,jon-3/Core
|Server=notaffected,eap-6/ja |Server=notaffected,eap-6/ja
|ckson-databind=affected,dts |ckson-databind=affected,dts
|-4/devtoolset-4-jackson-dat |-4/devtoolset-4-jackson-dat
|abind=wontfix,rhscl-3/rh-ma |abind=wontfix,rhscl-3/rh-ma
|ven35-jackson-databind=affe |ven35-jackson-databind=affe
|cted |cted
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1501529] CVE-2017-12629 Solr: Code execution via entity expansion
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1501529
Martin Prpič <mprpic(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=critical,public=2017 |impact=critical,public=2017
|1012,reported=20171008,sour |1012,reported=20171012,sour
|ce=internet,cvss2=10/AV:N/A |ce=internet,cvss2=10/AV:N/A
|C:L/Au:N/C:C/I:C/A:C,cvss3= |C:L/Au:N/C:C/I:C/A:C,cvss3=
|9.8/CVSS:3.0/AV:N/AC:L/PR:N |9.8/CVSS:3.0/AV:N/AC:L/PR:N
|/UI:N/S:U/C:H/I:H/A:H,cwe=C |/UI:N/S:U/C:H/I:H/A:H,cwe=C
|WE-138,eap-6/solr=notaffect |WE-138,eap-6/solr=notaffect
|ed,eap-7/lucene=affected/im |ed,eap-7/lucene=affected/im
|pact=moderate,jpp-6/solr=no |pact=moderate,jpp-6/solr=no
|taffected/impact=moderate,r |taffected/impact=moderate,r
|hsso-7/lucene=notaffected/i |hsso-7/lucene=notaffected/i
|mpact=moderate,jdg-7/lucene |mpact=moderate,jdg-7/lucene
|=affected/impact=moderate,f |=affected/impact=moderate,f
|use-6/Camel=notaffected,brm |use-6/Camel=notaffected,brm
|s-6/lucene=notaffected,bpms |s-6/lucene=notaffected,bpms
|-6/lucene=notaffected,rhev- |-6/lucene=notaffected,rhev-
|m-4/lucene=notaffected/impa |m-4/lucene=notaffected/impa
|ct=moderate,rhel-5/lucene=n |ct=moderate,rhel-5/lucene=n
|otaffected,rhel-6/lucene=wo |otaffected,rhel-6/lucene=wo
|ntfix/impact=moderate,rhscl |ntfix/impact=moderate,rhscl
|-3/rh-java-common-lucene=af |-3/rh-java-common-lucene=af
|fected/impact=moderate,rhsc |fected/impact=moderate,rhsc
|l-3/rh-java-common-lucene5= |l-3/rh-java-common-lucene5=
|affected/impact=moderate,fe |affected/impact=moderate,fe
|dora-all/lucene=affected,fe |dora-all/lucene=affected,fe
|dora-all/lucene4=affected,f |dora-all/lucene4=affected,f
|edora-all/lucene3=affected, |edora-all/lucene3=affected,
|fedora-all/solr3=affected,e |fedora-all/solr3=affected,e
|ap-6/lucene=notaffected,rhe |ap-6/lucene=notaffected,rhe
|l-8/lucene=affected |l-8/lucene=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months
[Bug 1543717] New: CVE-2018-1298 qpid-java: Incorrect implementation of some SASL mechanisms can allow a remote unauthenticated attacker to cause a denial of service
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1543717
Bug ID: 1543717
Summary: CVE-2018-1298 qpid-java: Incorrect implementation of
some SASL mechanisms can allow a remote
unauthenticated attacker to cause a denial of service
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, bcourt(a)redhat.com, bhu(a)redhat.com,
bkearney(a)redhat.com, chazlett(a)redhat.com,
esammons(a)redhat.com, hghasemb(a)redhat.com,
iboverma(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmatthew(a)redhat.com, jross(a)redhat.com,
kpalko(a)redhat.com, matt(a)redhat.com,
mcressma(a)redhat.com, messaging-bugs(a)redhat.com,
mmccune(a)redhat.com, mrike(a)redhat.com,
ohadlevy(a)redhat.com, puntogil(a)libero.it,
rchan(a)redhat.com, rrajasek(a)redhat.com,
tjay(a)redhat.com, tsanders(a)redhat.com,
williams(a)redhat.com
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in
functionality for authentication of connections for AMQP protocols 0-8, 0-9,
0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability
allows an unauthenticated attacker to crash the broker instance. AMQP 1.0 and
HTTP connections are not affected.
The following Authentication Providers support PLAIN SAML and are affected:
- Plain
- PlainPasswordFile
- SimpleLDAP
- Base64MD5PasswordFile
- MD5
- SCRAM-SHA-256
- SCRAM-SHA-1
The following Authentication Providers support XOAUTH2 SAML and are affected:
- OAuth2
The current implementation of SASL mechanisms PLAIN and XOAUTH2 require from
client to provide an initial response. PLAIN and XOAUTH2 sasl mechanism
implementations should send challenge (empty bytes) if initial response is not
provided.
Upstream Issue:
https://issues.apache.org/jira/browse/QPID-8046
Upstream Patches:
https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=de509dd
https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=30ca170
https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=4b9fb37
External References:
https://tools.ietf.org/html/rfc4616
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 2 months