[Bug 1592988] New: javapackages-tools FTBFS on python 3.7
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1592988
Bug ID: 1592988
Summary: javapackages-tools FTBFS on python 3.7
Product: Fedora
Version: rawhide
Component: javapackages-tools
Priority: high
Assignee: mizdebsk(a)redhat.com
Reporter: mhroncok(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: ctubbsii(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com,
sochotni(a)redhat.com
Blocks: 1565020 (PYTHON37)
javapackages-tools-5.2.0-2.fc29
https://koji.fedoraproject.org/koji/taskinfo?taskID=27733181
File "/builddir/build/BUILD/javapackages-5.2.0/test/test_common.py", line 27
def call_script(name, args, stdin=None, extra_env={}, async=False):
^
SyntaxError: invalid syntax
https://docs.python.org/3.7/whatsnew/3.7.html#summary-release-highlights
> async and await are now reserved keywords.
The fix si to rename that argument.
This blocks other packages, please rename it soon.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1565020
[Bug 1565020] Python 3.7
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1564408] CVE-2018-1272 spring-framework: Multipart content pollution
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1564408
Andrej Nemec <anemec(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags|needinfo?(anemec(a)redhat.com |
|) |
--- Comment #5 from Andrej Nemec <anemec(a)redhat.com> ---
(In reply to Happy Mia from comment #4)
> (In reply to Andrej Nemec from comment #0)
> > Spring Framework provides client-side support for multipart requests. When
> > Spring MVC or Spring WebFlux server application (server A) receives input
> > from a remote client, and then uses that input to make a multipart request
> > to another server (server B), it can be exposed to an attack, where an extra
> > multipart is inserted in the content of the request from server A, causing
> > server B to use the wrong value for a part it expects. This could to lead
> > privilege escalation, for example, if the part content represents a username
> > or user roles.
> >
> > In order for the attacker to succeed, they would have to be able to guess
> > the multipart boundary value chosen by server A for the multipart request to
> > server B, which requires the attacker to also have control of the server or
> > the ability to see the HTTP log of server A through a separate attack vector.
> >
> > External References:
> >
> > https://pivotal.io/security/cve-2018-1272
>
> I want to reproduce the CVE-2018-1272 vulnerability in my project.
> Please explain me how to attack this vulnerability. Thanks!
Red Hat Product Security Team does not provide reproducers for security issues
to external parties.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1564408] CVE-2018-1272 spring-framework: Multipart content pollution
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1564408
Happy Mia <hoanhoan9595(a)gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |anemec(a)redhat.com,
| |hoanhoan9595(a)gmail.com
Flags| |needinfo?(anemec(a)redhat.com
| |)
--- Comment #4 from Happy Mia <hoanhoan9595(a)gmail.com> ---
(In reply to Andrej Nemec from comment #0)
> Spring Framework provides client-side support for multipart requests. When
> Spring MVC or Spring WebFlux server application (server A) receives input
> from a remote client, and then uses that input to make a multipart request
> to another server (server B), it can be exposed to an attack, where an extra
> multipart is inserted in the content of the request from server A, causing
> server B to use the wrong value for a part it expects. This could to lead
> privilege escalation, for example, if the part content represents a username
> or user roles.
>
> In order for the attacker to succeed, they would have to be able to guess
> the multipart boundary value chosen by server A for the multipart request to
> server B, which requires the attacker to also have control of the server or
> the ability to see the HTTP log of server A through a separate attack vector.
>
> External References:
>
> https://pivotal.io/security/cve-2018-1272
I want to reproduce the CVE-2018-1272 vulnerability in my project.
Please explain me how to attack this vulnerability. Thanks!
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1550671] CVE-2018-1067 undertow: HTTP header injection using CRLF with UTF-8 Encoding ( incomplete fix of CVE-2016-4993)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1550671
Doran Moppert <dmoppert(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0425:1751,reported=20180301 |0425:1751,reported=20180301
|,source=researcher,cvss2=5. |,source=researcher,cvss2=5.
|8/AV:N/AC:M/Au:N/C:P/I:P/A: |8/AV:N/AC:M/Au:N/C:P/I:P/A:
|N,cvss3=5.4/CVSS:3.0/AV:N/A |N,cvss3=5.4/CVSS:3.0/AV:N/A
|C:L/PR:N/UI:R/S:U/C:L/I:L/A |C:L/PR:N/UI:R/S:U/C:L/I:L/A
|:N,cwe=CWE-113,fedora-all/w |:N,cwe=CWE-113,fedora-all/w
|ildfly=affected,eap-6/jboss |ildfly=affected,eap-6/jboss
|web=notaffected,eap-7/under |web=notaffected,eap-7/under
|tow=affected,openshift-1/jb |tow=affected,openshift-1/jb
|ossweb=affected,rhel-6/tomc |ossweb=affected,rhel-6/tomc
|at6=notaffected,rhel-7/tomc |at6=notaffected,rhel-7/tomc
|at=notaffected,jbews-2/tomc |at=notaffected,jbews-2/tomc
|at7=notaffected,jbews-2/tom |at7=notaffected,jbews-2/tom
|cat6=notaffected,eap-7/wild |cat6=notaffected,eap-7/wild
|fly=new,jdg-7/wildfly=new,r |fly=new,jdg-7/wildfly=new,r
|hev-m-4/eap7-wildfly=notaff |hev-m-4/eap7-wildfly=notaff
|ected,rhsso-7/wildfly=new,j |ected,rhsso-7/wildfly=new,j
|dg-6/jbossweb=new,eap-5/jbo |dg-6/jbossweb=new,eap-5/jbo
|ssweb=new,brms-5/jbossweb=w |ssweb=new,brms-5/jbossweb=w
|ontfix,soap-5/jbossweb=wont |ontfix,soap-5/jbossweb=wont
|fix,fsw-6/jbossweb=wontfix, |fix,fsw-6/jbossweb=wontfix,
|fuse-6/jbossweb=wontfix,fed |fuse-6/jbossweb=wontfix,fed
|ora-all/tomcat=affected,epe |ora-all/tomcat=affected,epe
|l-6/tomcat=new,rhel-5/tomca |l-6/tomcat=notaffected,rhel
|t5=notaffected,rhel-8/tomca |-5/tomcat5=notaffected,rhel
|t=notaffected,rhscl-3/rh-ja |-8/tomcat=notaffected,rhscl
|va-common-tomcat=notaffecte |-3/rh-java-common-tomcat=no
|d,swarm-7/undertow=new,fedo |taffected,swarm-7/undertow=
|ra-all/undertow=new,rhev-m- |new,fedora-all/undertow=aff
|4/eap7-undertow=affected |ected,rhev-m-4/eap7-underto
| |w=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months
[Bug 1550671] CVE-2018-1067 undertow: HTTP header injection using CRLF with UTF-8 Encoding ( incomplete fix of CVE-2016-4993)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1550671
Doran Moppert <dmoppert(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC|java-maint(a)redhat.com |
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0425:1751,reported=20180301 |0425:1751,reported=20180301
|,source=researcher,cvss2=5. |,source=researcher,cvss2=5.
|8/AV:N/AC:M/Au:N/C:P/I:P/A: |8/AV:N/AC:M/Au:N/C:P/I:P/A:
|N,cvss3=5.4/CVSS:3.0/AV:N/A |N,cvss3=5.4/CVSS:3.0/AV:N/A
|C:L/PR:N/UI:R/S:U/C:L/I:L/A |C:L/PR:N/UI:R/S:U/C:L/I:L/A
|:N,cwe=CWE-113,fedora-all/w |:N,cwe=CWE-113,fedora-all/w
|ildfly=affected,eap-6/jboss |ildfly=affected,eap-6/jboss
|web=notaffected,eap-7/under |web=notaffected,eap-7/under
|tow=affected,openshift-1/jb |tow=affected,openshift-1/jb
|ossweb=affected,rhel-6/tomc |ossweb=affected,rhel-6/tomc
|at6=notaffected,rhel-7/tomc |at6=notaffected,rhel-7/tomc
|at=notaffected,jbews-2/tomc |at=notaffected,jbews-2/tomc
|at7=notaffected,jbews-2/tom |at7=notaffected,jbews-2/tom
|cat6=notaffected,eap-7/wild |cat6=notaffected,eap-7/wild
|fly=new,jdg-7/wildfly=new,r |fly=new,jdg-7/wildfly=new,r
|hel-8/wildfly-core=notaffec |hev-m-4/eap7-wildfly=notaff
|ted,rhev-m-4/eap7-wildfly=n |ected,rhsso-7/wildfly=new,j
|otaffected,rhsso-7/wildfly= |dg-6/jbossweb=new,eap-5/jbo
|new,jdg-6/jbossweb=new,eap- |ssweb=new,brms-5/jbossweb=w
|5/jbossweb=new,brms-5/jboss |ontfix,soap-5/jbossweb=wont
|web=wontfix,soap-5/jbossweb |fix,fsw-6/jbossweb=wontfix,
|=wontfix,fsw-6/jbossweb=won |fuse-6/jbossweb=wontfix,fed
|tfix,fuse-6/jbossweb=wontfi |ora-all/tomcat=affected,epe
|x,fedora-all/tomcat=affecte |l-6/tomcat=new,rhel-5/tomca
|d,epel-6/tomcat=new,rhel-5/ |t5=notaffected,rhel-8/tomca
|tomcat5=notaffected,rhel-8/ |t=notaffected,rhscl-3/rh-ja
|tomcat=notaffected,rhscl-3/ |va-common-tomcat=notaffecte
|rh-java-common-tomcat=notaf |d,swarm-7/undertow=new,fedo
|fected,swarm-7/undertow=new |ra-all/undertow=new,rhev-m-
|,fedora-all/undertow=new,rh |4/eap7-undertow=affected
|ev-m-4/eap7-undertow=affect |
|ed,rhel-8/undertow=new |
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 11 months