[Bug 1595639] New: CVE-2017-7656 jetty: HTTP request smuggling using the range header
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1595639
Bug ID: 1595639
Summary: CVE-2017-7656 jetty: HTTP request smuggling using the
range header
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abergmann(a)suse.com, aileenc(a)redhat.com,
bkearney(a)redhat.com, chazlett(a)redhat.com,
ggainey(a)redhat.com, gvarsami(a)redhat.com,
hghasemb(a)redhat.com, hhorak(a)redhat.com,
java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjohnstn(a)redhat.com,
jorton(a)redhat.com, kconner(a)redhat.com,
krzysztof.daniel(a)gmail.com, ldimaggi(a)redhat.com,
meissner(a)suse.de, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, nwallace(a)redhat.com,
rwagner(a)redhat.com, sochotni(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com
Blocks: 1595623
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and
9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is
handled poorly. An HTTP/1 style request line (i.e. method space URI space
version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9
request. If deployed behind an intermediary that also accepted and passed
through the 0.9 version (but did not act on it), then the response sent could
be interpreted by the intermediary as HTTP/1 headers. This could be used to
poison the cache if the server allowed the origin client to generate arbitrary
content in the response.
Upstream issue:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1595621] New: CVE-2017-7658 jetty: Incorrect header handling
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1595621
Bug ID: 1595621
Summary: CVE-2017-7658 jetty: Incorrect header handling
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: abergmann(a)suse.com, aileenc(a)redhat.com,
bkearney(a)redhat.com, chazlett(a)redhat.com,
ggainey(a)redhat.com, gvarsami(a)redhat.com,
hghasemb(a)redhat.com, hhorak(a)redhat.com,
java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjohnstn(a)redhat.com,
jorton(a)redhat.com, kconner(a)redhat.com,
krzysztof.daniel(a)gmail.com, ldimaggi(a)redhat.com,
meissner(a)suse.de, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, nwallace(a)redhat.com,
rwagner(a)redhat.com, sochotni(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x
configurations), and 9.4.x (all HTTP/1.x configurations), when presented with
two content-lengths headers, Jetty ignored the second. When presented with a
content-length and a chunked encoding header, the content-length was ignored
(as per RFC 2616). If an intermediary decided on the shorter length, but still
passed on the longer body, then body content could be interpreted by Jetty as a
pipelined request. If the intermediary was imposing authorization, the fake
pipelined request would bypass that authorization.
Upstream issue:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1618574] New: CVE-2018-11771 apache-commons-compress: ZipArchiveInputStream.read() fails to identify correct EOF allowing for DoS via crafted zip [ fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1618574
Bug ID: 1618574
Summary: CVE-2018-11771 apache-commons-compress:
ZipArchiveInputStream.read() fails to identify correct
EOF allowing for DoS via crafted zip [fedora-all]
Product: Fedora
Version: 28
Component: apache-commons-compress
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: mizdebsk(a)redhat.com
Reporter: sfowler(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
sandro(a)mathys.io, SpikeFedora(a)gmail.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1597418] New: CVE-2018-12536 jetty: full server path revealed when using the default Error Handling
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1597418
Bug ID: 1597418
Summary: CVE-2018-12536 jetty: full server path revealed when
using the default Error Handling
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: abergmann(a)suse.com, bkearney(a)redhat.com,
ggainey(a)redhat.com, hghasemb(a)redhat.com,
hhorak(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, jorton(a)redhat.com,
krzysztof.daniel(a)gmail.com, meissner(a)suse.de,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
sochotni(a)redhat.com, tlestach(a)redhat.com
A flaw was found in Eclipse Jetty Server, all 9.x versions. On webapps deployed
using default Error Handling, when an intentionally bad query arrives that
doesn't match a dynamic url-pattern, and is eventually handled by the
DefaultServlet's static file serving, the bad characters can trigger a
java.nio.file.InvalidPathException which includes the full path to the base
resource directory that the DefaultServlet and/or webapp is using. If this
InvalidPathException is then handled by the default Error Handler, the
InvalidPathException message is included in the error response, revealing the
full server path to the requesting system.
References:
http://www.securitytracker.com/id/1041194
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1564405] New: CVE-2018-1270 spring-framework: Possible RCE via spring messaging
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1564405
Bug ID: 1564405
Summary: CVE-2018-1270 spring-framework: Possible RCE via
spring messaging
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: urgent
Priority: urgent
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, apevec(a)redhat.com,
apintea(a)redhat.com, bkundal(a)redhat.com,
bmaxwell(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, chrisw(a)redhat.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dchen(a)redhat.com, dffrench(a)redhat.com,
dimitris(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, drusso(a)redhat.com,
etirelli(a)redhat.com, fgavrilo(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hghasemb(a)redhat.com, ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jmadigan(a)redhat.com, jolee(a)redhat.com,
jondruse(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lgriffin(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lpetrovi(a)redhat.com,
markmc(a)redhat.com, mbabacek(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
myarboro(a)redhat.com, ngough(a)redhat.com,
nwallace(a)redhat.com, nyechiel(a)redhat.com,
paradhya(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pjurak(a)redhat.com,
ppalaga(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, psotirop(a)redhat.com,
pszubiak(a)redhat.com, puntogil(a)libero.it,
pwright(a)redhat.com, rbryant(a)redhat.com,
rnetuka(a)redhat.com, rrajasek(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sclewis(a)redhat.com,
sdaley(a)redhat.com, sisharma(a)redhat.com,
slinaber(a)redhat.com, smohan(a)redhat.com,
ssaha(a)redhat.com, sstavrev(a)redhat.com,
tcunning(a)redhat.com, tdecacqu(a)redhat.com,
tjay(a)redhat.com, tkirby(a)redhat.com, trepel(a)redhat.com,
twalsh(a)redhat.com, vbellur(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com,
weli(a)redhat.com
Spring Framework allows applications to expose STOMP over WebSocket endpoints
with a simple, in-memory STOMP broker through the spring-messaging module. A
malicious user (or attacker) can craft a message to the broker that can lead to
a remote code execution attack.
External References:
https://pivotal.io/security/cve-2018-1270
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1565307] New: CVE-2018-1275 CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1565307
Bug ID: 1565307
Summary: CVE-2018-1275 CVE-2018-1275 spring-framework: Address
partial fix for CVE-2018-1270
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: urgent
Priority: urgent
Assignee: security-response-team(a)redhat.com
Reporter: chazlett(a)redhat.com
CC: bkundal(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dchen(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, myarboro(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, puntogil(a)libero.it,
rnetuka(a)redhat.com, rsvoboda(a)redhat.com,
twalsh(a)redhat.com, vtunka(a)redhat.com
Blocks: 1565298
CVE-2018-1270, which permitted a malicious user to craft a STOMP message that
could lead to remote code execution, was not fully addressed in the 4.3.x
branch of the Spring Framework.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1548289] New: CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unitended exposure of resources
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1548289
Bug ID: 1548289
Summary: CVE-2018-1304 tomcat: Incorrect handling of empty
string URL in security constraints can lead to
unitended exposure of resources
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: alee(a)redhat.com, apintea(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
ccoleman(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dedgar(a)redhat.com,
dimitris(a)redhat.com, dmcphers(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
fgavrilo(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jdoyle(a)redhat.com, jgoulding(a)redhat.com,
jolee(a)redhat.com, jondruse(a)redhat.com,
jorton(a)redhat.com, jschatte(a)redhat.com,
jshepherd(a)redhat.com, jstastny(a)redhat.com,
krzysztof.daniel(a)gmail.com, lgao(a)redhat.com,
loleary(a)redhat.com, mbabacek(a)redhat.com,
me(a)coolsvap.net, mizdebsk(a)redhat.com,
myarboro(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pjurak(a)redhat.com,
ppalaga(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
spinder(a)redhat.com, sstavrev(a)redhat.com,
theute(a)redhat.com, twalsh(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com,
weli(a)redhat.com
Apache Tomcat versions 7.0.0 to 7.0.84, 8.0.0.RC1 to 8.0.49 and 8.5.0 to 8.5.27
does not properly handle the URL empty string ("") when used as part of a
security constraint definition. This can lead to the security constraint being
ignored, leading to unitended exposure of resources.
External References:
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.85
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.50
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.28
Upstream Bug Report:
https://bz.apache.org/bugzilla/show_bug.cgi?id=62067
Upstream Fixes:
Tomcat 7.0.x:
http://svn.apache.org/viewvc?view=rev&rev=1823309
Tomcat 8.0.x:
http://svn.apache.org/viewvc?view=rev&rev=1814827
Tomcat 8.5.x:
http://svn.apache.org/viewvc?view=rev&rev=1823307
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1548282] New: CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1548282
Bug ID: 1548282
Summary: CVE-2018-1305 tomcat: Late application of security
constraints can lead to resource exposure for
unauthorised users
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: alee(a)redhat.com, apintea(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
ccoleman(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dedgar(a)redhat.com,
dimitris(a)redhat.com, dmcphers(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
fgavrilo(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jdoyle(a)redhat.com, jgoulding(a)redhat.com,
jolee(a)redhat.com, jondruse(a)redhat.com,
jorton(a)redhat.com, jschatte(a)redhat.com,
jshepherd(a)redhat.com, jstastny(a)redhat.com,
krzysztof.daniel(a)gmail.com, lgao(a)redhat.com,
loleary(a)redhat.com, mbabacek(a)redhat.com,
me(a)coolsvap.net, mizdebsk(a)redhat.com,
myarboro(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pjurak(a)redhat.com,
ppalaga(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
spinder(a)redhat.com, sstavrev(a)redhat.com,
theute(a)redhat.com, twalsh(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com,
weli(a)redhat.com
Apache Tomcat versions 7.0.0 to 7.0.84, 8.0.0.RC1 to 8.0.49 and 8.5.0 to 8.5.27
only apply security constraints defined by Servlets once those Servlets are
loaded. Depending on the order that Servlets load, some security constraints
may not be applied leading to unintended resource exposure.
External References:
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.85
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.50
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.28
Upstream Fixes:
Tomcat 7.0.x:
http://svn.apache.org/viewvc?view=rev&rev=1823322
http://svn.apache.org/viewvc?view=rev&rev=1824360
Tomcat 8.0.x:
http://svn.apache.org/viewvc?view=rev&rev=1823319
http://svn.apache.org/viewvc?view=rev&rev=1824359
Tomcat 8.5.x:
http://svn.apache.org/viewvc?view=rev&rev=1823314
http://svn.apache.org/viewvc?view=rev&rev=1824358
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1494283] New: CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1494283
Bug ID: 1494283
Summary: CVE-2017-12617 tomcat: Remote Code Execution bypass
for CVE-2017-12615
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: jshepherd(a)redhat.com
CC: akurtako(a)redhat.com, alee(a)redhat.com,
apintea(a)redhat.com, bkundal(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dedgar(a)redhat.com, dimitris(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
felias(a)redhat.com, fgavrilo(a)redhat.com,
gzaronik(a)redhat.com, hchiorea(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, jolee(a)redhat.com,
jondruse(a)redhat.com, jorton(a)redhat.com,
jshepherd(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, loleary(a)redhat.com,
mbabacek(a)redhat.com, me(a)coolsvap.net,
mizdebsk(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pjurak(a)redhat.com,
ppalaga(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
spinder(a)redhat.com, sstavrev(a)redhat.com,
theute(a)redhat.com, twalsh(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com,
weli(a)redhat.com
Blocks: 1493229
When running on Windows with HTTP PUTs enabled (e.g. via setting the readonly
initialisation parameter of the Default to false) it was possible to upload a
JSP file to the server via a specially crafted request. This JSP could then be
requested and any code it contained would be executed by the server. This issue
affects Apache Tomcat versions up to and including 7.0.81. The fix for
CVE-2017-12615 does not prevent this issue.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months