[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1528565
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71212,reported=20171206,sou |71212,reported=20171206,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,eap-6/reste |S:U/C:H/I:H/A:H,eap-6/reste
|asy=affected,fedora-all/jac |asy=affected,fedora-all/jac
|kson-databind=affected,jdg- |kson-databind=affected,jdg-
|7/jackson-databind=notaffec |7/jackson-databind=notaffec
|ted,jon-3/resteasy=affected |ted,jon-3/resteasy=affected
|,openshift-enterprise-2/jac |,openshift-enterprise-2/jac
|kson-databind=affected,dts- |kson-databind=affected,dts-
|4/devtoolset-4-jackson-data |4/devtoolset-4-jackson-data
|bind=wontfix,rhev-m-3/jaspe |bind=wontfix,rhev-m-3/jaspe
|rreports-server-pro=wontfix |rreports-server-pro=wontfix
|,rhev-m-4/eap7-jackson-data |,rhev-m-4/eap7-jackson-data
|bind=affected,amq-6/jackson |bind=affected,amq-6/jackson
|-databind=notaffected,bpms- |-databind=notaffected,bpms-
|6/jackson-databind=new,jdv- |6/jackson-databind=new,jdv-
|6/jackson-databind=notaffec |6/jackson-databind=notaffec
|ted,fuse-6/jackson-databind |ted,fuse-6/jackson-databind
|=notaffected,rhmap-4/jackso |=notaffected,rhmap-4/jackso
|n-databind=notaffected,rhn_ |n-databind=notaffected,rhn_
|satellite_6/jackson-databin |satellite_6/jackson-databin
|d=new,rhscl-3/rh-eclipse46- |d=new,rhscl-3/rh-eclipse46-
|jackson-databind=affected,r |jackson-databind=affected,r
|hscl-3/rh-maven35-jackson-d |hscl-3/rh-maven35-jackson-d
|atabind=affected,sam-1/jack |atabind=affected,sam-1/jack
|son-databind=wontfix,eap-7/ |son-databind=wontfix,eap-7/
|resteasy=affected,brms-6/ja |resteasy=affected,brms-6/ja
|ckson-databind=new,swarm-7/ |ckson-databind=new,swarm-7/
|jackson-databind=new,vertx- |jackson-databind=affected,v
|3/jackson-databind=notaffec |ertx-3/jackson-databind=not
|ted |affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1528565
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71212,reported=20171206,sou |71212,reported=20171206,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,eap-6/reste |S:U/C:H/I:H/A:H,eap-6/reste
|asy=affected,fedora-all/jac |asy=affected,fedora-all/jac
|kson-databind=affected,jdg- |kson-databind=affected,jdg-
|7/jackson-databind=notaffec |7/jackson-databind=notaffec
|ted,jon-3/resteasy=affected |ted,jon-3/resteasy=affected
|,openshift-enterprise-2/jac |,openshift-enterprise-2/jac
|kson-databind=affected,dts- |kson-databind=affected,dts-
|4/devtoolset-4-jackson-data |4/devtoolset-4-jackson-data
|bind=wontfix,rhev-m-3/jaspe |bind=wontfix,rhev-m-3/jaspe
|rreports-server-pro=wontfix |rreports-server-pro=wontfix
|,rhev-m-4/eap7-jackson-data |,rhev-m-4/eap7-jackson-data
|bind=affected,amq-6/jackson |bind=affected,amq-6/jackson
|-databind=notaffected,bpms- |-databind=notaffected,bpms-
|6/jackson-databind=new,jdv- |6/jackson-databind=new,jdv-
|6/jackson-databind=notaffec |6/jackson-databind=notaffec
|ted,fuse-6/jackson-databind |ted,fuse-6/jackson-databind
|=notaffected,rhmap-4/jackso |=notaffected,rhmap-4/jackso
|n-databind=notaffected,rhn_ |n-databind=notaffected,rhn_
|satellite_6/jackson-databin |satellite_6/jackson-databin
|d=new,rhscl-3/rh-eclipse46- |d=new,rhscl-3/rh-eclipse46-
|jackson-databind=affected,r |jackson-databind=affected,r
|hscl-3/rh-maven35-jackson-d |hscl-3/rh-maven35-jackson-d
|atabind=affected,sam-1/jack |atabind=affected,sam-1/jack
|son-databind=wontfix,eap-7/ |son-databind=wontfix,eap-7/
|resteasy=affected,brms-6/ja |resteasy=affected,brms-6/ja
|ckson-databind=new,swarm-7/ |ckson-databind=new,swarm-7/
|jackson-databind=new,vertx- |jackson-databind=new,vertx-
|3/jackson-databind=new |3/jackson-databind=notaffec
| |ted
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1528565
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |avibelli(a)redhat.com,
| |bgeorges(a)redhat.com,
| |jbalunas(a)redhat.com,
| |jpallich(a)redhat.com,
| |lthon(a)redhat.com,
| |mszynkie(a)redhat.com,
| |pgallagh(a)redhat.com,
| |rruss(a)redhat.com,
| |trogers(a)redhat.com
Whiteboard|impact=important,public=201 |impact=important,public=201
|71212,reported=20171206,sou |71212,reported=20171206,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,eap-6/reste |S:U/C:H/I:H/A:H,eap-6/reste
|asy=affected,fedora-all/jac |asy=affected,fedora-all/jac
|kson-databind=affected,jdg- |kson-databind=affected,jdg-
|7/jackson-databind=notaffec |7/jackson-databind=notaffec
|ted,jon-3/resteasy=affected |ted,jon-3/resteasy=affected
|,openshift-enterprise-2/jac |,openshift-enterprise-2/jac
|kson-databind=affected,dts- |kson-databind=affected,dts-
|4/devtoolset-4-jackson-data |4/devtoolset-4-jackson-data
|bind=wontfix,rhev-m-3/jaspe |bind=wontfix,rhev-m-3/jaspe
|rreports-server-pro=wontfix |rreports-server-pro=wontfix
|,rhev-m-4/eap7-jackson-data |,rhev-m-4/eap7-jackson-data
|bind=affected,amq-6/jackson |bind=affected,amq-6/jackson
|-databind=notaffected,bpms- |-databind=notaffected,bpms-
|6/jackson-databind=new,jdv- |6/jackson-databind=new,jdv-
|6/jackson-databind=notaffec |6/jackson-databind=notaffec
|ted,fuse-6/jackson-databind |ted,fuse-6/jackson-databind
|=notaffected,rhmap-4/jackso |=notaffected,rhmap-4/jackso
|n-databind=notaffected,rhn_ |n-databind=notaffected,rhn_
|satellite_6/jackson-databin |satellite_6/jackson-databin
|d=new,rhscl-3/rh-eclipse46- |d=new,rhscl-3/rh-eclipse46-
|jackson-databind=affected,r |jackson-databind=affected,r
|hscl-3/rh-maven35-jackson-d |hscl-3/rh-maven35-jackson-d
|atabind=affected,sam-1/jack |atabind=affected,sam-1/jack
|son-databind=wontfix,eap-7/ |son-databind=wontfix,eap-7/
|resteasy=affected,brms-6/ja |resteasy=affected,brms-6/ja
|ckson-databind=new |ckson-databind=new,swarm-7/
| |jackson-databind=new,vertx-
| |3/jackson-databind=new
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1629991] New: CVE-2018-16999 nasm: Invalid memory write ( segmentation fault) in expand_smacro in preproc.c [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1629991
Bug ID: 1629991
Summary: CVE-2018-16999 nasm: Invalid memory write
(segmentation fault) in expand_smacro in preproc.c
[fedora-all]
Product: Fedora
Version: 28
Component: nasm
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: mizdebsk(a)redhat.com
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1629919] New: CVE-2018-11087 springframework-amqp: Improper hostname validation [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1629919
Bug ID: 1629919
Summary: CVE-2018-11087 springframework-amqp: Improper hostname
validation [fedora-all]
Product: Fedora
Version: 28
Component: springframework-amqp
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: puntogil(a)libero.it
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1629918] New: CVE-2018-11087 springframework-amqp: Improper hostname validation
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1629918
Bug ID: 1629918
Summary: CVE-2018-11087 springframework-amqp: Improper hostname
validation
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to
2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname
validation. A malicious user that has the ability to intercept traffic would be
able to view data in transit.
References:
https://pivotal.io/security/cve-2018-11087
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1629087] New: CVE-2018-11775 activemq: ActiveMQ Client Missing TLS Hostname Verification [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1629087
Bug ID: 1629087
Summary: CVE-2018-11775 activemq: ActiveMQ Client Missing TLS
Hostname Verification [fedora-all]
Product: Fedora
Version: 28
Component: activemq
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: puntogil(a)libero.it
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: agrimm(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it, s(a)shk.io, tdawson(a)redhat.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1626550] New: nasm: NULL Pointer Dereference in asm/labels.c [ fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1626550
Bug ID: 1626550
Summary: nasm: NULL Pointer Dereference in asm/labels.c
[fedora-all]
Product: Fedora
Version: 28
Component: nasm
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: mizdebsk(a)redhat.com
Reporter: lpardo(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months
[Bug 1626257] New: CVE-2018-1000667 nasm: Memory corruption in assemble_file() function in asm/nasm.c:482 [ fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1626257
Bug ID: 1626257
Summary: CVE-2018-1000667 nasm: Memory corruption in
assemble_file() function in asm/nasm.c:482
[fedora-all]
Product: Fedora
Version: 28
Component: nasm
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: mizdebsk(a)redhat.com
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 7 months