[Bug 1508110] CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1508110
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |chazlett(a)redhat.com
Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
|0524,reported=20160524,sour |0524,reported=20160524,sour
|ce=cve,cvss3=6.4/CVSS:3.0/A |ce=cve,cvss3=6.4/CVSS:3.0/A
|V:N/AC:L/PR:L/UI:N/S:C/C:L/ |V:N/AC:L/PR:L/UI:N/S:C/C:L/
|I:L/A:N,cwe=CWE-352,fedora- |I:L/A:N,cwe=CWE-352,fedora-
|all/xmlrpc=affected,rhel-5/ |all/xmlrpc=affected,rhel-5/
|xmlrpc=wontfix,rhel-6/xmlrp |xmlrpc=wontfix,rhel-6/xmlrp
|c3=wontfix,rhel-7/xmlrpc=wo |c3=wontfix,rhel-7/xmlrpc=wo
|ntfix,rhev-m-3/xmlrpc-commo |ntfix,rhev-m-3/xmlrpc-commo
|n=wontfix,rhscl-3/rh-java-c |n=wontfix,rhscl-3/rh-java-c
|ommon-xmlrpc=affected,rhes- |ommon-xmlrpc=affected,rhes-
|3/xmlrpc-common=wontfix,jbd |3/xmlrpc-common=wontfix,jbd
|s-8/xmlrpc=notaffected,jbds |s-8/xmlrpc=notaffected,jbds
|-10/xmlrpc=notaffected,open |-10/xmlrpc=notaffected,open
|shift-enterprise-3/xmlrpc-c |shift-enterprise-3/xmlrpc-c
|ommon=notaffected,fis-2/cam |ommon=notaffected,fuse-6/xm
|el-xmlrpc=new,fis-2/xmlrpc- |lrpc-common=new,fis-2/xmlrp
|common=new |c-common=new
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years
[Bug 1508110] CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1508110
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |hghasemb(a)redhat.com
Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
|0524,reported=20160524,sour |0524,reported=20160524,sour
|ce=cve,cvss3=6.4/CVSS:3.0/A |ce=cve,cvss3=6.4/CVSS:3.0/A
|V:N/AC:L/PR:L/UI:N/S:C/C:L/ |V:N/AC:L/PR:L/UI:N/S:C/C:L/
|I:L/A:N,cwe=CWE-352,fedora- |I:L/A:N,cwe=CWE-352,fedora-
|all/xmlrpc=affected,rhel-5/ |all/xmlrpc=affected,rhel-5/
|xmlrpc=wontfix,rhel-6/xmlrp |xmlrpc=wontfix,rhel-6/xmlrp
|c3=wontfix,rhel-7/xmlrpc=wo |c3=wontfix,rhel-7/xmlrpc=wo
|ntfix,rhev-m-3/xmlrpc-commo |ntfix,rhev-m-3/xmlrpc-commo
|n=wontfix,rhscl-3/rh-java-c |n=wontfix,rhscl-3/rh-java-c
|ommon-xmlrpc=affected,rhes- |ommon-xmlrpc=affected,rhes-
|3/xmlrpc-common=wontfix,jbd |3/xmlrpc-common=wontfix,jbd
|s-8/xmlrpc=notaffected,jbds |s-8/xmlrpc=notaffected,jbds
|-10/xmlrpc=notaffected,fuse |-10/xmlrpc=notaffected,open
|-6/camel-xmlrpc=new,openshi |shift-enterprise-3/xmlrpc-c
|ft-enterprise-3/xmlrpc-comm |ommon=notaffected,fis-2/cam
|on=notaffected |el-xmlrpc=new,fis-2/xmlrpc-
| |common=new
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years
[Bug 1508110] CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1508110
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
|0524,reported=20160524,sour |0524,reported=20160524,sour
|ce=cve,cvss3=6.4/CVSS:3.0/A |ce=cve,cvss3=6.4/CVSS:3.0/A
|V:N/AC:L/PR:L/UI:N/S:C/C:L/ |V:N/AC:L/PR:L/UI:N/S:C/C:L/
|I:L/A:N,cwe=CWE-352,fedora- |I:L/A:N,cwe=CWE-352,fedora-
|all/xmlrpc=affected,rhel-5/ |all/xmlrpc=affected,rhel-5/
|xmlrpc=wontfix,rhel-6/xmlrp |xmlrpc=wontfix,rhel-6/xmlrp
|c3=wontfix,rhel-7/xmlrpc=wo |c3=wontfix,rhel-7/xmlrpc=wo
|ntfix,rhev-m-3/xmlrpc-commo |ntfix,rhev-m-3/xmlrpc-commo
|n=wontfix,rhscl-3/rh-java-c |n=wontfix,rhscl-3/rh-java-c
|ommon-xmlrpc=affected,rhes- |ommon-xmlrpc=affected,rhes-
|3/xmlrpc-common=wontfix,jbd |3/xmlrpc-common=wontfix,jbd
|s-8/xmlrpc=new,jbds-10/xmlr |s-8/xmlrpc=notaffected,jbds
|pc=new,fuse-6/camel-xmlrpc= |-10/xmlrpc=notaffected,fuse
|new,openshift-enterprise-3/ |-6/camel-xmlrpc=new,openshi
|xmlrpc-common=notaffected |ft-enterprise-3/xmlrpc-comm
| |on=notaffected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years
[Bug 1553565] New: spring-security: LdapUserDetailsManager.java: changePassword() allows for direct modificiation of user passwords, bypassing the security configuration
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1553565
Bug ID: 1553565
Summary: spring-security:
LdapUserDetailsManager.java:changePassword() allows
for direct modificiation of user passwords, bypassing
the security configuration
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: aileenc(a)redhat.com, apevec(a)redhat.com,
chazlett(a)redhat.com, chrisw(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jschluet(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, ldimaggi(a)redhat.com,
lhh(a)redhat.com, lpeer(a)redhat.com, markmc(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
nwallace(a)redhat.com, nyechiel(a)redhat.com,
pavelp(a)redhat.com, puntogil(a)libero.it,
rbryant(a)redhat.com, rwagner(a)redhat.com,
sclewis(a)redhat.com, slinaber(a)redhat.com,
tcunning(a)redhat.com, tdecacqu(a)redhat.com,
tkirby(a)redhat.com
Spring Security through version 5.0.3, allows for direct modification of user
passwords in the LdapUserDetailsManager.java:changePassword() function, which
conflicts with RFC 3062 and allows for security configuration bypass.
Upstream Issue:
https://github.com/spring-projects/spring-security/issues/3392
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years
[Bug 1372129] New: CVE-2016-6348 RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1372129
Bug ID: 1372129
Summary: CVE-2016-6348 RESTEasy: Use of JacksonJsonpInterceptor
in RESTEasy can lead to Cross Site Script Inclusion
attack
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: jshepherd(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, aszczucz(a)redhat.com,
bazulay(a)redhat.com, bbaranow(a)redhat.com,
bdawidow(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmcclain(a)redhat.com,
cbillett(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dblechte(a)redhat.com, dosoudil(a)redhat.com,
eedri(a)redhat.com, epp-bugs(a)redhat.com,
etirelli(a)redhat.com, felias(a)redhat.com,
fnasser(a)redhat.com, gklein(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
hfnukal(a)redhat.com, huwang(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jbpapp-maint(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jmatthew(a)redhat.com,
jolee(a)redhat.com, jpallich(a)redhat.com,
jshepherd(a)redhat.com, katello-bugs(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lpetrovi(a)redhat.com,
lsurette(a)redhat.com, mbaluch(a)redhat.com,
mgoldboi(a)redhat.com, mgoldman(a)redhat.com,
miburman(a)redhat.com, michal.skrivanek(a)redhat.com,
mmccune(a)redhat.com, mweiler(a)redhat.com,
mwinkler(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, ohadlevy(a)redhat.com,
oourfali(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pkliczew(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
puntogil(a)libero.it, rcernich(a)redhat.com,
Rhev-m-bugs(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
satellite6-bugs(a)redhat.com, sherold(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, tomckay(a)redhat.com,
tsanders(a)redhat.com, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com, ydary(a)redhat.com,
ykaul(a)redhat.com
It was found that in some configurations the JacksonJsonpInterceptor is
activated by default in RESTEasy. An attacker could use this flaw to launch a
Cross Site Scripting Inclusion attack.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1372117] New: CVE-2016-6345 RESTEasy: Insufficient use of random values in RESTEasy async jobs could lead to loss of data confidentiality
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1372117
Bug ID: 1372117
Summary: CVE-2016-6345 RESTEasy: Insufficient use of random
values in RESTEasy async jobs could lead to loss of
data confidentiality
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: jshepherd(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, aszczucz(a)redhat.com,
bazulay(a)redhat.com, bbaranow(a)redhat.com,
bdawidow(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmcclain(a)redhat.com,
cbillett(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dblechte(a)redhat.com, dosoudil(a)redhat.com,
eedri(a)redhat.com, epp-bugs(a)redhat.com,
etirelli(a)redhat.com, felias(a)redhat.com,
fnasser(a)redhat.com, gklein(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
hfnukal(a)redhat.com, huwang(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jbpapp-maint(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jmatthew(a)redhat.com,
jolee(a)redhat.com, jpallich(a)redhat.com,
jshepherd(a)redhat.com, katello-bugs(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lpetrovi(a)redhat.com,
lsurette(a)redhat.com, mbaluch(a)redhat.com,
mgoldboi(a)redhat.com, mgoldman(a)redhat.com,
miburman(a)redhat.com, michal.skrivanek(a)redhat.com,
mmccune(a)redhat.com, mweiler(a)redhat.com,
mwinkler(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, ohadlevy(a)redhat.com,
oourfali(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pkliczew(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
puntogil(a)libero.it, rcernich(a)redhat.com,
Rhev-m-bugs(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
satellite6-bugs(a)redhat.com, sherold(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, tomckay(a)redhat.com,
tsanders(a)redhat.com, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com, ydary(a)redhat.com,
ykaul(a)redhat.com
It was found that there was insufficient use of randam values in RESTEasy async
jobs. An attacker could use this flaw to steal user data.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1372124] CVE-2016-6347 RESTEasy: Use of the default exception handler in RESTEasy can lead to reflected XSS attack
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1372124
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
|0901,reported=20160829,sour |0901,reported=20160829,sour
|ce=researcher,cvss2=4.3/AV: |ce=researcher,cvss2=4.3/AV:
|N/AC:M/Au:N/C:N/I:P/A:N,cvs |N/AC:M/Au:N/C:N/I:P/A:N,cvs
|s3=5.4/CVSS:3.0/AV:N/AC:H/P |s3=5.4/CVSS:3.0/AV:N/AC:H/P
|R:N/UI:N/S:C/C:L/I:L/A:N,cw |R:N/UI:N/S:C/C:L/I:L/A:N,cw
|e=CWE-20,eap-7/REST=affecte |e=CWE-20,eap-7/REST=affecte
|d,fedora-all/resteasy=affec |d,fedora-all/resteasy=affec
|ted,eap-6/RESTEasy=notaffec |ted,eap-6/RESTEasy=notaffec
|ted,eap-5/jbossas=wontfix,b |ted,eap-5/jbossas=wontfix,b
|pms-6/Build and |pms-6/Build and
|Assembly=notaffected,brms-6 |Assembly=notaffected,brms-6
|/Build and |/Build and
|Assembly=notaffected,jdg-6/ |Assembly=notaffected,jdg-6/
|Build=affected,jdv-6/Produc |Build=notaffected,jdv-6/Pro
|tization=notaffected,brms-5 |ductization=notaffected,brm
|/Security=wontfix,soap-5/Se |s-5/Security=wontfix,soap-5
|curity=wontfix,fsw-6/Switch |/Security=wontfix,fsw-6/Swi
|Yard=notaffected,fuse-6/Swi |tchYard=notaffected,fuse-6/
|tchYard=affected,jon-3/REST |SwitchYard=affected,jon-3/R
|=wontfix,jpp-6/Requirements |EST=wontfix,jpp-6/Requireme
|=notaffected,rhsso-7/Core=n |nts=notaffected,rhsso-7/Cor
|otaffected,rhev-m-3/vdsm-js |e=notaffected,rhev-m-3/vdsm
|onrpc-java=new,rhn_satellit |-jsonrpc-java=new,rhn_satel
|e_6/Security=affected,sam-1 |lite_6/Security=affected,sa
|/katello=new |m-1/katello=new,jdg-7/reste
| |asy=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1372124] CVE-2016-6347 RESTEasy: Use of the default exception handler in RESTEasy can lead to reflected XSS attack
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1372124
Chess Hazlett <chazlett(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |drieden(a)redhat.com,
| |pdrozd(a)redhat.com,
| |sthorger(a)redhat.com
Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
|0901,reported=20160829,sour |0901,reported=20160829,sour
|ce=researcher,cvss2=4.3/AV: |ce=researcher,cvss2=4.3/AV:
|N/AC:M/Au:N/C:N/I:P/A:N,cvs |N/AC:M/Au:N/C:N/I:P/A:N,cvs
|s3=5.4/CVSS:3.0/AV:N/AC:H/P |s3=5.4/CVSS:3.0/AV:N/AC:H/P
|R:N/UI:N/S:C/C:L/I:L/A:N,cw |R:N/UI:N/S:C/C:L/I:L/A:N,cw
|e=CWE-20,eap-7/REST=affecte |e=CWE-20,eap-7/REST=affecte
|d,fedora-all/resteasy=affec |d,fedora-all/resteasy=affec
|ted,eap-6/RESTEasy=notaffec |ted,eap-6/RESTEasy=notaffec
|ted,eap-5/jbossas=wontfix,b |ted,eap-5/jbossas=wontfix,b
|pms-6/Build and |pms-6/Build and
|Assembly=notaffected,brms-6 |Assembly=notaffected,brms-6
|/Build and |/Build and
|Assembly=notaffected,jdg-6/ |Assembly=notaffected,jdg-6/
|Build=new,jdv-6/Productizat |Build=affected,jdv-6/Produc
|ion=notaffected,brms-5/Secu |tization=notaffected,brms-5
|rity=wontfix,soap-5/Securit |/Security=wontfix,soap-5/Se
|y=wontfix,fsw-6/SwitchYard= |curity=wontfix,fsw-6/Switch
|notaffected,fuse-6/SwitchYa |Yard=notaffected,fuse-6/Swi
|rd=affected,jon-3/REST=wont |tchYard=affected,jon-3/REST
|fix,jpp-6/Requirements=new, |=wontfix,jpp-6/Requirements
|rhsso-7/Core=new,rhev-m-3/v |=notaffected,rhsso-7/Core=n
|dsm-jsonrpc-java=new,rhn_sa |otaffected,rhev-m-3/vdsm-js
|tellite_6/Security=affected |onrpc-java=new,rhn_satellit
|,sam-1/katello=new |e_6/Security=affected,sam-1
| |/katello=new
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month
[Bug 1567675] New: jsoup-1.11.3 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1567675
Bug ID: 1567675
Summary: jsoup-1.11.3 is available
Product: Fedora
Version: rawhide
Component: jsoup
Keywords: FutureFeature, Triaged
Assignee: msimacek(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
Latest upstream release: 1.11.3
Current version/release in rawhide: 1.11.2-2.fc28
URL: http://jsoup.org/download
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1479/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 1 month