[Bug 1578119] New: jmdns is outdated
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1578119
Bug ID: 1578119
Summary: jmdns is outdated
Product: Fedora
Version: 28
Component: jmdns
Assignee: msrb(a)redhat.com
Reporter: jszinger(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
jmdns is outdated. The current release is 3.5.4. Fedora has
jmdns-3.4.1-14.fc28
Also the project has moved to github: https://github.com/jmdns/jmdns
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1524945] New: jenkins-plugin-script-security: Arbitrary file read vulnerability in Script Security Plugin (SECURITY-663 )
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1524945
Bug ID: 1524945
Summary: jenkins-plugin-script-security: Arbitrary file read
vulnerability in Script Security Plugin (SECURITY-663)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Users with the ability to configure sandboxed Groovy and Pipeline scripts,
including those from SCM, are able to use a type coercion feature in Groovy to
create new File objects from strings. This allowed reading arbitrary files on
the Jenkins master file system.
Affected versions: Script Security Plugin up to and including 1.36
External References:
https://jenkins.io/security/advisory/2017-12-11/
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1462702
--- Comment #57 from Andrej Nemec <anemec(a)redhat.com> ---
Statement:
This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1)
and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as
shipped with Red Hat Satellite 6.x. However the affected code is NOT used at
this time:
Candlepin currently uses the default type resolution configuration for the
ObjectMappers it creates/uses. Nowhere in candlepin do we enable global
polymorphic deserialization via enableDefaultTyping(...), therefore based on
the documentation sited BZ 1462702 , candlepin should not be affected.
However as the vulnerable software ships with the product we have marked them
as vulnerable to ensure the issue is tracked.
JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling
and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise
about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is
available here:
https://access.redhat.com/solutions/3279231
Although JBoss Fuse ships the vulnerable version of jackson-databind, it does
not call on enableDefaultTyping() for any polymorphic deserialization
operations which is the root cause of this vulnerability. We have raised a Jira
tracker to ensure that jackson-databind will be upgraded for Fuse 7.0, however
due to feasibility issues jackson-databind cannot be upgraded in JBoss Fuse
6.3.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1459158] New: CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1459158
Bug ID: 1459158
Summary: CVE-2017-5664 tomcat: Security constrained bypass in
error page mechanism
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aileenc(a)redhat.com, alee(a)redhat.com,
apintea(a)redhat.com, bkundal(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dedgar(a)redhat.com, dimitris(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
felias(a)redhat.com, fgavrilo(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, hhorak(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, joelsmith(a)redhat.com,
jolee(a)redhat.com, jondruse(a)redhat.com,
jorton(a)redhat.com, jshepherd(a)redhat.com,
kconner(a)redhat.com, krzysztof.daniel(a)gmail.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, mbabacek(a)redhat.com,
me(a)coolsvap.net, mizdebsk(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, pgier(a)redhat.com,
pjurak(a)redhat.com, ppalaga(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
rnetuka(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rwagner(a)redhat.com,
spinder(a)redhat.com, sstavrev(a)redhat.com,
tcunning(a)redhat.com, theute(a)redhat.com,
tkirby(a)redhat.com, trick(a)vanstaveren.us,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
The error page mechanism of the Java Servlet Specification requires that, when
an error occurs and an error page is configured for the error that occurred,
the original request and response are forwarded to the error page. This means
that the request is presented to the error page with the original HTTP method.
If the error page is a static file, expected behaviour is to serve content of
the file as if processing a GET request, regardless of the actual HTT method.
Tomcat's Default Servlet did not do this. Depending on the original request
this could lead to unexpected and undesirable results for static error pages
including, if the DefaultServlet is configured to permit writes, the
replacement or removal of the custom error page.
Affects: 7.0.0 to 7.0.77, 8.0.0.RC1 to 8.0.43, 8.5.0 to 8.5.14
Upstream fixes:
Tomcat 7.x:
https://svn.apache.org/viewvc?view=revision&revision=1793471
https://svn.apache.org/viewvc?view=revision&revision=1793491
Tomcat 8.0.x:
https://svn.apache.org/viewvc?view=revision&revision=1793470
https://svn.apache.org/viewvc?view=revision&revision=1793489
Tomcat 8.5.x:
https://svn.apache.org/viewvc?view=revision&revision=1793469
https://svn.apache.org/viewvc?view=revision&revision=1793488
External References:
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months