[Bug 1576358] New: java.util.zip.ZipException: invalid entry compressed size during Eclipse build using xmvn
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1576358
Bug ID: 1576358
Summary: java.util.zip.ZipException: invalid entry compressed
size during Eclipse build using xmvn
Product: Fedora
Version: 28
Component: xmvn
Assignee: mizdebsk(a)redhat.com
Reporter: mat.booth(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
I've suddenly started experiencing this error in F28 koschie builds for
aarch64:
https://apps.fedoraproject.org/koschei/package/eclipse?collection=f28
Here is sample log file output from
https://kojipkgs.fedoraproject.org//work/tasks/3719/26813719/build.log
+ xmvn-install -R .xmvn-reactor -n eclipse -d
/builddir/build/BUILDROOT/eclipse-4.7.3a-4.fc28.aarch64
Unhandled exception
java.lang.RuntimeException: java.util.zip.ZipException: invalid entry
compressed size (expected 16792 but got 16793 bytes)
at
org.fedoraproject.xmvn.tools.install.JarUtils.injectManifest(JarUtils.java:271)
at
org.fedoraproject.xmvn.tools.install.impl.DefaultArtifactInstaller.install(DefaultArtifactInstaller.java:85)
at
org.fedoraproject.xmvn.tools.install.impl.DefaultInstaller.installArtifact(DefaultInstaller.java:223)
at
org.fedoraproject.xmvn.tools.install.impl.DefaultInstaller.install(DefaultInstaller.java:335)
at
org.fedoraproject.xmvn.tools.install.cli.InstallerCli.run(InstallerCli.java:57)
at
org.fedoraproject.xmvn.tools.install.cli.InstallerCli.main(InstallerCli.java:82)
Caused by: java.util.zip.ZipException: invalid entry compressed size (expected
16792 but got 16793 bytes)
at java.util.zip.ZipOutputStream.closeEntry(ZipOutputStream.java:267)
at java.util.zip.ZipOutputStream.putNextEntry(ZipOutputStream.java:192)
at java.util.jar.JarOutputStream.putNextEntry(JarOutputStream.java:109)
at
org.fedoraproject.xmvn.tools.install.JarUtils.injectManifest(JarUtils.java:261)
... 5 more
Suppressed: java.util.zip.ZipException: invalid entry compressed size
(expected 16792 but got 16793 bytes)
at java.util.zip.ZipOutputStream.closeEntry(ZipOutputStream.java:267)
at java.util.zip.ZipOutputStream.finish(ZipOutputStream.java:360)
at
java.util.zip.DeflaterOutputStream.close(DeflaterOutputStream.java:238)
at java.util.zip.ZipOutputStream.close(ZipOutputStream.java:377)
at
org.fedoraproject.xmvn.tools.install.JarUtils.injectManifest(JarUtils.java:267)
... 5 more
This looks exactly like bug 1566614 I reported earlier against the rh-maven35
collection.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1578582] New: CVE-2018-1258 spring-framework: Unauthorized Access with Spring Security Method Security
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1578582
Bug ID: 1578582
Summary: CVE-2018-1258 spring-framework: Unauthorized Access
with Spring Security Method Security
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, apevec(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
chrisw(a)redhat.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dchen(a)redhat.com,
dffrench(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
drusso(a)redhat.com, etirelli(a)redhat.com,
gvarsami(a)redhat.com, hghasemb(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jjoyce(a)redhat.com, jmadigan(a)redhat.com,
jolee(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lgriffin(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lpetrovi(a)redhat.com,
markmc(a)redhat.com, mburns(a)redhat.com,
myarboro(a)redhat.com, ngough(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pavelp(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
pszubiak(a)redhat.com, puntogil(a)libero.it,
pwright(a)redhat.com, rbryant(a)redhat.com,
rhel8-maint(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sclewis(a)redhat.com,
sdaley(a)redhat.com, sisharma(a)redhat.com,
slinaber(a)redhat.com, smohan(a)redhat.com,
ssaha(a)redhat.com, tcunning(a)redhat.com,
tdecacqu(a)redhat.com, tjay(a)redhat.com,
tkirby(a)redhat.com, trepel(a)redhat.com,
twalsh(a)redhat.com, vbellur(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com
A flaw was found in Spring Security in combination with Spring Framework
versions prior to 5.0.6 contains an authorization bypass when using method
security. An unauthorized malicious user can gain unauthorized access to
methods that should be restricted.
References:
https://pivotal.io/security/cve-2018-1258
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1548290] New: CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unitended exposure of resources [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1548290
Bug ID: 1548290
Summary: CVE-2018-1304 tomcat: Incorrect handling of empty
string URL in security constraints can lead to
unitended exposure of resources [fedora-all]
Product: Fedora
Version: 27
Component: tomcat
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: ivan.afonichev(a)gmail.com
Reporter: sfowler(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 12 months
[Bug 1548291] New: CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unitended exposure of resources [epel-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1548291
Bug ID: 1548291
Summary: CVE-2018-1304 tomcat: Incorrect handling of empty
string URL in security constraints can lead to
unitended exposure of resources [epel-all]
Product: Fedora EPEL
Version: epel7
Component: tomcat
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: ivan.afonichev(a)gmail.com
Reporter: sfowler(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, me(a)coolsvap.net
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora EPEL. While
only one tracking bug has been filed, please correct all affected versions
at the same time. If you need to fix the versions independent of each
other, you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 12 months
[Bug 1581543] New: CVE-2018-8012 zookeeper: No authentication or authorization is enforced when a server joins a quorum [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1581543
Bug ID: 1581543
Summary: CVE-2018-8012 zookeeper: No authentication or
authorization is enforced when a server joins a quorum
[fedora-all]
Product: Fedora
Version: 28
Component: zookeeper
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: tstclair(a)heptio.com
Reporter: sfowler(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: ctubbsii(a)fedoraproject.org, greg.hellings(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mluscon(a)gmail.com, s(a)shk.io, tstclair(a)heptio.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 12 months
[Bug 1550671] CVE-2018-1067 undertow: HTTP header injection using CRLF with UTF-8 Encoding ( incomplete fix of CVE-2016-4993)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1550671
Timothy Walsh <twalsh(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0425:1751,reported=20180301 |0425:1751,reported=20180301
|,source=researcher,cvss2=5. |,source=researcher,cvss2=5.
|8/AV:N/AC:M/Au:N/C:P/I:P/A: |8/AV:N/AC:M/Au:N/C:P/I:P/A:
|N,cvss3=5.4/CVSS:3.0/AV:N/A |N,cvss3=5.4/CVSS:3.0/AV:N/A
|C:L/PR:N/UI:R/S:U/C:L/I:L/A |C:L/PR:N/UI:R/S:U/C:L/I:L/A
|:N,cwe=CWE-113,fedora-all/w |:N,cwe=CWE-113,fedora-all/w
|ildfly=affected,eap-6/jboss |ildfly=affected,eap-6/jboss
|web=notaffected,eap-7/under |web=notaffected,eap-7/under
|tow=affected,openshift-1/jb |tow=affected,openshift-1/jb
|ossweb=affected,rhel-6/tomc |ossweb=affected,rhel-6/tomc
|at6=notaffected,rhel-7/tomc |at6=notaffected,rhel-7/tomc
|at=notaffected,jbews-2/tomc |at=notaffected,jbews-2/tomc
|at7=new,jbews-2/tomcat6=new |at7=notaffected,jbews-2/tom
|,eap-7/wildfly=new,jdg-7/wi |cat6=notaffected,eap-7/wild
|ldfly=new,rhel-8/wildfly-co |fly=new,jdg-7/wildfly=new,r
|re=new,rhev-m-4/eap7-wildfl |hel-8/wildfly-core=new,rhev
|y=new,rhsso-7/wildfly=new,j |-m-4/eap7-wildfly=new,rhsso
|dg-6/jbossweb=new,eap-5/jbo |-7/wildfly=new,jdg-6/jbossw
|ssweb=new,brms-5/jbossweb=w |eb=new,eap-5/jbossweb=new,b
|ontfix,soap-5/jbossweb=wont |rms-5/jbossweb=wontfix,soap
|fix,fsw-6/jbossweb=wontfix, |-5/jbossweb=wontfix,fsw-6/j
|fuse-6/jbossweb=wontfix,fed |bossweb=wontfix,fuse-6/jbos
|ora-all/tomcat=affected,epe |sweb=wontfix,fedora-all/tom
|l-6/tomcat=new,rhel-5/tomca |cat=affected,epel-6/tomcat=
|t5=notaffected,rhel-8/tomca |new,rhel-5/tomcat5=notaffec
|t=notaffected,rhscl-3/rh-ja |ted,rhel-8/tomcat=notaffect
|va-common-tomcat=notaffecte |ed,rhscl-3/rh-java-common-t
|d,swarm-7/undertow=new,fedo |omcat=notaffected,swarm-7/u
|ra-all/undertow=new,rhev-m- |ndertow=new,fedora-all/unde
|4/eap7-undertow=new,rhel-8/ |rtow=new,rhev-m-4/eap7-unde
|undertow=new |rtow=new,rhel-8/undertow=ne
| |w
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 12 months