[Bug 1562174] New: New upstream version available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1562174
Bug ID: 1562174
Summary: New upstream version available
Product: Fedora
Version: 27
Component: apache-commons-jcs
Assignee: puntogil(a)libero.it
Reporter: fedora(a)genodeftest.de
QA Contact: extras-qa(a)fedoraproject.org
CC: cedric.olivier(a)free.fr,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Description of problem:
Upstream has seen a few updates missing here.
Version-Release number of selected component (if applicable):
Upstream: 2.2
Fedora: 2.0 Beta 5/6
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1508110] CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1508110
Hooman Broujerdi <hghasemb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
|0524,reported=20160524,sour |0524,reported=20160524,sour
|ce=cve,cvss3=6.4/CVSS:3.0/A |ce=cve,cvss3=6.4/CVSS:3.0/A
|V:N/AC:L/PR:L/UI:N/S:C/C:L/ |V:N/AC:L/PR:L/UI:N/S:C/C:L/
|I:L/A:N,cwe=CWE-352,fedora- |I:L/A:N,cwe=CWE-352,fedora-
|all/xmlrpc=affected,rhel-5/ |all/xmlrpc=affected,rhel-5/
|xmlrpc=wontfix,rhel-6/xmlrp |xmlrpc=wontfix,rhel-6/xmlrp
|c3=wontfix,rhel-7/xmlrpc=wo |c3=wontfix,rhel-7/xmlrpc=wo
|ntfix,rhev-m-3/xmlrpc-commo |ntfix,rhev-m-3/xmlrpc-commo
|n=wontfix,rhscl-3/rh-java-c |n=wontfix,rhscl-3/rh-java-c
|ommon-xmlrpc=affected,rhes- |ommon-xmlrpc=affected,rhes-
|3/xmlrpc-common=wontfix,jbd |3/xmlrpc-common=wontfix,jbd
|s-8/xmlrpc=notaffected,jbds |s-8/xmlrpc=notaffected,jbds
|-10/xmlrpc=notaffected,open |-10/xmlrpc=notaffected,open
|shift-enterprise-3/xmlrpc-c |shift-enterprise-3/xmlrpc-c
|ommon=notaffected,fuse-6/xm |ommon=notaffected,fuse-6/ca
|lrpc-common=new,fis-2/xmlrp |mel=affected,fis-2/xmlrpc-c
|c-common=new |ommon=affected,fuse-7/camel
| |=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1465573] CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1465573
Hooman Broujerdi <hghasemb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0926,reported=20170627,sour |0926,reported=20170627,sour
|ce=redhat,cvss3=6.3/CVSS:3. |ce=redhat,cvss3=6.3/CVSS:3.
|0/AV:L/AC:H/PR:L/UI:N/S:U/C |0/AV:L/AC:H/PR:L/UI:N/S:U/C
|:H/I:H/A:N,fedora-all/hiber |:H/I:H/A:N,fedora-all/hiber
|nate-validator=affected,bpm |nate-validator=affected,bpm
|s-6/hibernate-validator=not |s-6/hibernate-validator=not
|affected,brms-6/hibernate-v |affected,brms-6/hibernate-v
|alidator=notaffected,jdg-6/ |alidator=notaffected,jdg-6/
|hibernate-validator=new,jdg |hibernate-validator=new,jdg
|-7/hibernate-validator=new, |-7/hibernate-validator=new,
|jdv-6/hibernate-validator=n |jdv-6/hibernate-validator=n
|otaffected,eap-5/hibernate- |otaffected,eap-5/hibernate-
|validator=new,eap-6/hiberna |validator=new,eap-6/hiberna
|te-validator=notaffected,ea |te-validator=notaffected,ea
|p-7/hibernate-validator=aff |p-7/hibernate-validator=aff
|ected,soap-5/hibernate-vali |ected,soap-5/hibernate-vali
|dator=notaffected,fsw-6/hib |dator=notaffected,fsw-6/hib
|ernate-validator=notaffecte |ernate-validator=notaffecte
|d,fuse-6/camel=affected,jon |d,fuse-6/camel=notaffected,
|-3/hibernate-validator=new, |jon-3/hibernate-validator=n
|jpp-6/hibernate-validator=n |ew,jpp-6/hibernate-validato
|ew,openshift-enterprise-2/h |r=new,openshift-enterprise-
|ibernate-validator=wontfix, |2/hibernate-validator=wontf
|rhev-m-3/hibernate-validato |ix,rhev-m-3/hibernate-valid
|r=wontfix,rhn_satellite_6/h |ator=wontfix,rhn_satellite_
|ibernate-validator=affected |6/hibernate-validator=affec
|,rhmap-4/hibernate-validato |ted,rhmap-4/hibernate-valid
|r=notaffected,rhev-m-4/eap7 |ator=notaffected,rhev-m-4/e
|-hibernate-validator=affect |ap7-hibernate-validator=aff
|ed,fis-2/hibernate-validato |ected,fis-2/hibernate-valid
|r=affected,fuse-7/camel=aff |ator=affected,fuse-7/camel=
|ected |notaffected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1465573] CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1465573
Hooman Broujerdi <hghasemb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |hghasemb(a)redhat.com
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0926,reported=20170627,sour |0926,reported=20170627,sour
|ce=redhat,cvss3=6.3/CVSS:3. |ce=redhat,cvss3=6.3/CVSS:3.
|0/AV:L/AC:H/PR:L/UI:N/S:U/C |0/AV:L/AC:H/PR:L/UI:N/S:U/C
|:H/I:H/A:N,fedora-all/hiber |:H/I:H/A:N,fedora-all/hiber
|nate-validator=affected,bpm |nate-validator=affected,bpm
|s-6/hibernate-validator=not |s-6/hibernate-validator=not
|affected,brms-6/hibernate-v |affected,brms-6/hibernate-v
|alidator=notaffected,jdg-6/ |alidator=notaffected,jdg-6/
|hibernate-validator=new,jdg |hibernate-validator=new,jdg
|-7/hibernate-validator=new, |-7/hibernate-validator=new,
|jdv-6/hibernate-validator=n |jdv-6/hibernate-validator=n
|otaffected,eap-5/hibernate- |otaffected,eap-5/hibernate-
|validator=new,eap-6/hiberna |validator=new,eap-6/hiberna
|te-validator=notaffected,ea |te-validator=notaffected,ea
|p-7/hibernate-validator=aff |p-7/hibernate-validator=aff
|ected,soap-5/hibernate-vali |ected,soap-5/hibernate-vali
|dator=notaffected,fsw-6/hib |dator=notaffected,fsw-6/hib
|ernate-validator=notaffecte |ernate-validator=notaffecte
|d,fuse-6/hibernate-validato |d,fuse-6/camel=affected,jon
|r=new,jon-3/hibernate-valid |-3/hibernate-validator=new,
|ator=new,jpp-6/hibernate-va |jpp-6/hibernate-validator=n
|lidator=new,openshift-enter |ew,openshift-enterprise-2/h
|prise-2/hibernate-validator |ibernate-validator=wontfix,
|=wontfix,rhev-m-3/hibernate |rhev-m-3/hibernate-validato
|-validator=wontfix,rhn_sate |r=wontfix,rhn_satellite_6/h
|llite_6/hibernate-validator |ibernate-validator=affected
|=affected,rhmap-4/hibernate |,rhmap-4/hibernate-validato
|-validator=notaffected,rhev |r=notaffected,rhev-m-4/eap7
|-m-4/eap7-hibernate-validat |-hibernate-validator=affect
|or=affected |ed,fis-2/hibernate-validato
| |r=affected,fuse-7/camel=aff
| |ected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1570970] New: CVE-2018-5429 jasperreports: arbitrary code execution in analytic reports that contain scripting
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1570970
Bug ID: 1570970
Summary: CVE-2018-5429 jasperreports: arbitrary code execution
in analytic reports that contain scripting
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it,
rhel8-maint(a)redhat.com
A vulnerability in the report scripting component of TIBCO Software Inc.'s
TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO
JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO
JasperReports Library Community Edition, TIBCO JasperReports Library for
ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft
Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft
Studio Community Edition, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may
allow analytic reports that contain scripting to perform arbitrary code
execution. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports
Server: versions up to and including 6.2.4; 6.3.0; 6.3.2;6.3.3; 6.4.0; 6.4.2,
TIBCO JasperReports Server Community Edition: versions up to and including
6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and
including 6.4.2, TIBCO JasperReports Library: versions up to and including
6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.1; 6.4.2, TIBCO JasperReports Library
Community Edition: versions up to and including 6.4.3, TIBCO JasperReports
Library for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO
Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2,
TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including
6.4.2, TIBCO Jaspersoft Studio: versions up to and including 6.2.4; 6.3.0;
6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO Jaspersoft Studio Community Edition: versions
up to and including 6.4.3, TIBCO Jaspersoft Studio for ActiveMatrix BPM:
versions up to and including 6.4.2.
References:
https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1570973] New: CVE-2018-5430 jasperreports: read-only access to the contents of the web application for authenticated user
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1570973
Bug ID: 1570973
Summary: CVE-2018-5430 jasperreports: read-only access to the
contents of the web application for authenticated user
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it,
rhel8-maint(a)redhat.com
The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO
JasperReports Server Community Edition, TIBCO JasperReports Server for
ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO
Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may
allow any authenticated user read-only access to the contents of the web
application, including key configuration files. Affected releases include TIBCO
Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4;
6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition:
versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix
BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with
Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting
and Analytics for AWS: versions up to and including 6.4.2.
References:
https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1570974] New: CVE-2018-5431 jasperreports: persisted cross-site scripting (XSS) in the context of a non-default permissions configuration
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1570974
Bug ID: 1570974
Summary: CVE-2018-5431 jasperreports: persisted cross-site
scripting (XSS) in the context of a non-default
permissions configuration
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it,
rhel8-maint(a)redhat.com
The domain designer component of TIBCO Software Inc.'s TIBCO JasperReports
Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports
Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and
TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability which
may allow, in the context of a non-default permissions configuration, persisted
cross-site scripting (XSS) attacks. Affected releases include TIBCO Software
Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0;
6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition:
versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix
BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with
Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting
and Analytics for AWS: versions up to and including 6.4.2.
References:
https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month