[Bug 1632470] New: CVE-2018-11762 tika: XML entity expansion vulnerability due to lack of limit configuration [ fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1632470
Bug ID: 1632470
Summary: CVE-2018-11762 tika: XML entity expansion
vulnerability due to lack of limit configuration
[fedora-all]
Product: Fedora
Version: 28
Component: tika
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: puntogil(a)libero.it
Reporter: lpardo(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1607582] New: CVE-2018-8037 tomcat: Due to a mishandling of close in NIO/ NIO2 connectors user sessions can get mixed up
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1607582
Bug ID: 1607582
Summary: CVE-2018-8037 tomcat: Due to a mishandling of close in
NIO/NIO2 connectors user sessions can get mixed up
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, alee(a)redhat.com,
anstephe(a)redhat.com, apintea(a)redhat.com,
avibelli(a)redhat.com, bgeorges(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmoulliard(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dbaker(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, fgavrilo(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hghasemb(a)redhat.com, hhorak(a)redhat.com,
ibek(a)redhat.com, ikanello(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdoyle(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jondruse(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jschatte(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, loleary(a)redhat.com,
lpetrovi(a)redhat.com, lthon(a)redhat.com,
mbabacek(a)redhat.com, mizdebsk(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, pgier(a)redhat.com,
pjurak(a)redhat.com, ppalaga(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
pszubiak(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sdaley(a)redhat.com,
spinder(a)redhat.com, sstavrev(a)redhat.com,
sthangav(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
trankin(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
Flaw affecting tomcat 9.0.0.M9 to 9.0.9. A bug in the tracking of connection
closures can lead to reuse of user sessions in a new connection.
Upstream patch:
http://svn.apache.org/viewvc?view=rev&rev=1833906
References:
https://tomcat.apache.org/security-8.html
https://tomcat.apache.org/security-9.html
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1632454] New: CVE-2018-3831 elasticsearch: Information exposure via _cluster/settings API [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1632454
Bug ID: 1632454
Summary: CVE-2018-3831 elasticsearch: Information exposure via
_cluster/settings API [fedora-all]
Product: Fedora
Version: 28
Component: elasticsearch
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: emmanuel(a)seyman.fr
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: bobjensen(a)gmail.com, emmanuel(a)seyman.fr,
java-sig-commits(a)lists.fedoraproject.org,
jvanek(a)redhat.com, pahan(a)hubbitus.info,
zbyszek(a)in.waw.pl
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1620342] CVE-2018-1999043 jenkins: Ephemeral user record was created on some invalid authentication attempts
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1620342
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |eparis(a)redhat.com
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0815,reported=20180816,sour |0815,reported=20180816,sour
|ce=internet,cvss3=6.5/CVSS: |ce=internet,cvss3=6.5/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:N/I:L/A:L,cwe=CWE-287,fe |/C:N/I:L/A:L,cwe=CWE-287,fe
|dora-all/jenkins=affected,o |dora-all/jenkins=affected,o
|penshift-enterprise-3.1/jen |penshift-enterprise-3.1/jen
|kins=new,openshift-enterpri |kins=new,openshift-enterpri
|se-3.2/jenkins=new,openshif |se-3.2/jenkins=new,openshif
|t-enterprise-3.3/jenkins=ne |t-enterprise-3.3/jenkins=ne
|w,openshift-enterprise-3.4/ |w,openshift-enterprise-3.4/
|jenkins=new,openshift-enter |jenkins=new,openshift-enter
|prise-3.5/jenkins=new,opens |prise-3.5/jenkins=new,opens
|hift-enterprise-3.6/jenkins |hift-enterprise-3.6/jenkins
|=new,openshift-enterprise-3 |=new,openshift-enterprise-3
|.7/jenkins=new,openshift-en |.7/jenkins=new,openshift-en
|terprise-3.9/jenkins=new,op |terprise-3.9/jenkins=new,op
|enshift-enterprise-3.10/jen |enshift-enterprise-3.10/jen
|kins=new |kins=new,openshift-enterpri
| |se-3.11/jenkins=notaffected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months
[Bug 1609205] New: Jenkins fails to serve http requests
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1609205
Bug ID: 1609205
Summary: Jenkins fails to serve http requests
Product: Fedora
Version: 28
Component: jenkins
Assignee: msrb(a)redhat.com
Reporter: amitay(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Description of problem:
After fixing the wrong link for jenkins-antisamy-markup-formatter-plugin (bug
1609199), jenkins starts. But fails to serve any http requests.
Version-Release number of selected component (if applicable):
# rpm -q jenkins
jenkins-1.651.3-7.fc28.noarch
# rpm -q dom4j
dom4j-2.0.0-4.fc28.noarch
How reproducible:
There is another related bug (1609199) which fails to start jenkins. If the
problem of dangling link (to /usr/share/java/guava.jar) is fixed by updating
the link (to /usr/share/java/guava/guava.jar), then jenkins starts up.
If I try to connect to http://<jenkins-host-ip>:8080/, I get HTTP 500 error.
Steps to Reproduce:
1. On a fresh install of fedora 28, dnf install jenkins
2. systemctl start jenkins
3. Check /var/log/jenkins/jenkins.log
Actual results:
Jul 27, 2018 6:19:48 PM org.eclipse.jetty.util.log.JavaUtilLog warn
WARNING:
javax.servlet.ServletException: org.apache.commons.jelly.JellyTagException:
jar:file:/usr/share/jenkins/webroot/WEB-INF/lib/jenkins-core-1.651.3.jar!/lib/layout/layout.jelly:59:51:
<st:contentType> org.dom4j.io.HTMLWriter.setEnabled(Z)V
at org.kohsuke.stapler.jelly.JellyFacet$1.dispatch(JellyFacet.java:103)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:649)
at
hudson.init.impl.InstallUncaughtExceptionHandler$1.reportException(InstallUncaughtExceptionHandler.java:28)
at
org.kohsuke.stapler.compression.CompressionFilter.reportException(CompressionFilter.java:77)
at
org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:55)
at
org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1484)
at
hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
at
org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1484)
at
org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)
at
org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1476)
at
org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:501)
at
org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137)
at
org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:533)
at
org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231)
at
org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1086)
at
org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:429)
at
org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:193)
at
org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1020)
at
org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135)
at
org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)
at org.eclipse.jetty.server.Server.handle(Server.java:370)
at
org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:494)
at
org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:971)
at
org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:1033)
at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:644)
at
org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)
at
org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)
at
org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:696)
at
org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:53)
at
winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: org.apache.commons.jelly.JellyTagException:
jar:file:/usr/share/jenkins/webroot/WEB-INF/lib/jenkins-core-1.651.3.jar!/lib/layout/layout.jelly:59:51:
<st:contentType> org.dom4j.io.HTMLWriter.setEnabled(Z)V
at
org.apache.commons.jelly.impl.TagScript.handleException(TagScript.java:745)
at org.apache.commons.jelly.impl.TagScript.run(TagScript.java:289)
at org.apache.commons.jelly.impl.ScriptBlock.run(ScriptBlock.java:95)
at
org.apache.commons.jelly.tags.core.CoreTagLibrary$2.run(CoreTagLibrary.java:105)
at
org.kohsuke.stapler.jelly.CallTagLibScript.run(CallTagLibScript.java:120)
at org.apache.commons.jelly.impl.ScriptBlock.run(ScriptBlock.java:95)
at
org.apache.commons.jelly.tags.core.CoreTagLibrary$2.run(CoreTagLibrary.java:105)
at
org.kohsuke.stapler.jelly.JellyViewScript.run(JellyViewScript.java:95)
at
org.kohsuke.stapler.jelly.DefaultScriptInvoker.invokeScript(DefaultScriptInvoker.java:63)
at
org.kohsuke.stapler.jelly.DefaultScriptInvoker.invokeScript(DefaultScriptInvoker.java:53)
at org.kohsuke.stapler.jelly.JellyFacet$1.dispatch(JellyFacet.java:95)
... 34 more
Caused by: java.lang.NoSuchMethodError: org.dom4j.io.HTMLWriter.setEnabled(Z)V
at
org.kohsuke.stapler.jelly.HTMLWriterOutput.useHTML(HTMLWriterOutput.java:78)
at
org.kohsuke.stapler.jelly.ContentTypeTag.doTag(ContentTypeTag.java:52)
at org.apache.commons.jelly.impl.TagScript.run(TagScript.java:269)
... 43 more
Expected results:
Jenkins should serve http requests.
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 6 months