[Bug 1512827] New: CVE-2017-9096 itext: External entities not disabled
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1512827
Bug ID: 1512827
Summary: CVE-2017-9096 itext: External entities not disabled
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: alazarot(a)redhat.com, andjrobins(a)gmail.com,
anstephe(a)redhat.com, etirelli(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
kverlaen(a)redhat.com, lef(a)fedoraproject.org,
lpetrovi(a)redhat.com, oget.fedora(a)gmail.com,
paradhya(a)redhat.com, pavelp(a)redhat.com,
pszubiak(a)redhat.com, puntogil(a)libero.it,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
rzhang(a)redhat.com, sdaley(a)redhat.com
The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable
external entities, which might allow remote attackers to conduct XML external
entity (XXE) attacks via a crafted PDF.
External References:
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSN...
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 10 months
[Bug 1471060] New: CVE-2017-1000095 jenkins-plugin-script-security: Unsafe methods in the default whitelist (SECURITY-538)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1471060
Bug ID: 1471060
Summary: CVE-2017-1000095 jenkins-plugin-script-security:
Unsafe methods in the default whitelist (SECURITY-538)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com
The default whitelist included the entries:
DefaultGroovyMethods.putAt(Object, String, Object)
DefaultGroovyMethods.getAt(Object, String)
These allowed circumventing many of the access restrictions implemented in the
script sandbox by using e.g. currentBuild['rawBuild'] rather than
currentBuild.rawBuild.
Additionally, the following entries allowed accessing private data that would
not be accessible otherwise due to script security:
groovy.json.JsonOutput.toJson(Closure)
groovy.json.JsonOutput.toJson(Object)
External References:
https://jenkins.io/security/advisory/2017-07-10/
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 10 months
[Bug 1541553] New: source rpm does not rebuild properly
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1541553
Bug ID: 1541553
Summary: source rpm does not rebuild properly
Product: Fedora
Version: 27
Component: jogl2
Assignee: c.david86(a)gmail.com
Reporter: chris(a)chriscaudle.org
QA Contact: extras-qa(a)fedoraproject.org
CC: c.david86(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org
Created attachment 1390341
--> https://bugzilla.redhat.com/attachment.cgi?id=1390341&action=edit
capture of stdout messages
Description of problem:
Attempting to rebuild source rpm does not complete properly on x86_64
installation.
Version-Release number of selected component (if applicable):
jogl2-2.3.2-3.fc27.src.rpm
How reproducible:
Consistent
Steps to Reproduce:
1. Download jogl2-2.3.2-3.fc27.src.rpm
2. rpmbuild --rebuild ./jogl2-2.3.2-3.fc27.src.rpm
3.
Actual results:
Errors during build
Expected results:
Build either completes correctly or stops early if dependencies are not met.
Additional info:
One thing I noticed is that the build seems to be looking for
/usr/lib64/eclipse/swt.jar, but the eclipse-swt package installs into
/usr/lib/eclipse even with the x86_64 package. I copied the entire
/usr/lib/eclipse directory to /usr/lib64 but the build still stopped.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 10 months