[Bug 1595453] New: CVE-2018-12538 jetty: HttpSessions access/ hijack in the FileSystem's storage for the FileSessionDataStore.
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1595453
Bug ID: 1595453
Summary: CVE-2018-12538 jetty: HttpSessions access/hijack in
the FileSystem's storage for the FileSessionDataStore.
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: abergmann(a)suse.com, bkearney(a)redhat.com,
ggainey(a)redhat.com, hghasemb(a)redhat.com,
hhorak(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, jorton(a)redhat.com,
krzysztof.daniel(a)gmail.com, meissner(a)suse.de,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
sochotni(a)redhat.com, tlestach(a)redhat.com
A flaw was found in Eclipse Jetty versions 9.4.0 through 9.4.8, when using the
optional Jetty provided FileSessionDataStore for persistent storage of
HttpSession details, it is possible for a malicious user to access/hijack other
HttpSessions and even delete unmatched HttpSessions present in the FileSystem's
storage for the FileSessionDataStore.
References:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1595455] New: CVE-2018-12538 jetty: HttpSessions access/ hijack in the FileSystem's storage for the FileSessionDataStore. [ fedora-27]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1595455
Bug ID: 1595455
Summary: CVE-2018-12538 jetty: HttpSessions access/hijack in
the FileSystem's storage for the FileSessionDataStore.
[fedora-27]
Product: Fedora
Version: 27
Component: jetty
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: mizdebsk(a)redhat.com
Reporter: lpardo(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, krzysztof.daniel(a)gmail.com,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
sochotni(a)redhat.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-27.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1590964] New: IcedTea-web fails to run with connection failed after upgrade to Fedora 28
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1590964
Bug ID: 1590964
Summary: IcedTea-web fails to run with connection failed after
upgrade to Fedora 28
Product: Fedora EPEL
Version: epel7
Component: openjdk-orb
Assignee: lef(a)fedoraproject.org
Reporter: logank(a)wolfram.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, mgoldman(a)redhat.com,
puntogil(a)libero.it
Description of problem:
Using IcedTea-web and javaws to launch an IPMI interface worked in Fedora 27,
but since upgrading to Fedora 28, it fails with Connection Failed
Version-Release number of selected component (if applicable):
icedtea-web-1.7.1-6.fc28.noarch
How reproducible:
100%
Steps to Reproduce:
1. Launch jnlp file
2. Answer the dialog boxes
3. Wait for failure
Actual results:
Failed laugh of an IPMI window
Expected results:
Window allowing remote control of a server
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1541553] New: source rpm does not rebuild properly
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1541553
Bug ID: 1541553
Summary: source rpm does not rebuild properly
Product: Fedora
Version: 27
Component: jogl2
Assignee: c.david86(a)gmail.com
Reporter: chris(a)chriscaudle.org
QA Contact: extras-qa(a)fedoraproject.org
CC: c.david86(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org
Created attachment 1390341
--> https://bugzilla.redhat.com/attachment.cgi?id=1390341&action=edit
capture of stdout messages
Description of problem:
Attempting to rebuild source rpm does not complete properly on x86_64
installation.
Version-Release number of selected component (if applicable):
jogl2-2.3.2-3.fc27.src.rpm
How reproducible:
Consistent
Steps to Reproduce:
1. Download jogl2-2.3.2-3.fc27.src.rpm
2. rpmbuild --rebuild ./jogl2-2.3.2-3.fc27.src.rpm
3.
Actual results:
Errors during build
Expected results:
Build either completes correctly or stops early if dependencies are not met.
Additional info:
One thing I noticed is that the build seems to be looking for
/usr/lib64/eclipse/swt.jar, but the eclipse-swt package installs into
/usr/lib/eclipse even with the x86_64 package. I copied the entire
/usr/lib/eclipse directory to /usr/lib64 but the build still stopped.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months