[Bug 1738673] CVE-2019-10219 hibernate-validator: safeHTML validator allows XSS
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1738673
Marek Novotny <mnovotny(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |needinfo?(pjindal(a)redhat.co
| |m)
--- Comment #20 from Marek Novotny <mnovotny(a)redhat.com> ---
I looked for an usage of SafeHtml and there is no occurrence in the source code
so marking RHDM and RHPAM as affected just on existence of hibernate-validator
jar or dependency is invalid.
Searched the annotation class in sources:
"org.hibernate.validator.constraints.SafeHtml"
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 5 months
[Bug 1775300] New: CVE-2019-17531 jackson-databind: cve jackson-databind: enabling default typing leads to code execution [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1775300
Bug ID: 1775300
Summary: CVE-2019-17531 jackson-databind: cve jackson-databind:
enabling default typing leads to code execution
[fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: jackson-databind
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: decathorpe(a)gmail.com
Reporter: darunesh(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 5 months
[Bug 1775298] New: jackson-databind: cve jackson-databind: enabling default typing leads to code execution [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1775298
Bug ID: 1775298
Summary: jackson-databind: cve jackson-databind: enabling
default typing leads to code execution [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: jackson-databind
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: decathorpe(a)gmail.com
Reporter: darunesh(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 5 months
[Bug 1696062] New: CVE-2018-12545 jetty: large settings frames causing denial of service
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1696062
Bug ID: 1696062
Summary: CVE-2018-12545 jetty: large settings frames causing
denial of service
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190320,reported=20190328,sour
ce=cve,cvss3=4.2/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/
I:L/A:L,cwe=CWE-400,fedora-all/jetty=affected,rhel-6/j
etty-eclipse=notaffected,rhel-7/jetty=new,fuse-6/jetty
=affected,fuse-7/jetty=affected,rhn_satellite_5/jetty=
affected,rhscl-3/rh-java-common-jetty=affected
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: bkearney(a)redhat.com, chazlett(a)redhat.com,
decathorpe(a)gmail.com,
eclipse-sig(a)lists.fedoraproject.org,
ggainey(a)redhat.com, hhorak(a)redhat.com,
java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, jorton(a)redhat.com,
krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com,
sochotni(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
tlestach(a)redhat.com
Target Milestone: ---
Classification: Other
In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of
Service conditions if a remote client sends either large SETTINGs frames
container containing many settings, or many small SETTINGs frames. The
vulnerability is due to the additional CPU and memory allocations required to
handle changed settings
Reference:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 5 months