[Bug 1694857] New: CVE-2019-9658 checkstyle: Loads external DTDs by default
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1694857
Bug ID: 1694857
Summary: CVE-2019-9658 checkstyle: Loads external DTDs by
default
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190311,reported=20190311,sour
ce=cve,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/
I:H/A:N,cwe=CWE-20,fedora-all/checkstyle=affected
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: dbhole(a)redhat.com, decathorpe(a)gmail.com,
edewata(a)redhat.com, greg.hellings(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, nsantos(a)redhat.com,
rob.myers(a)gtri.gatech.edu,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Other
Checkstyle before 8.18 loads external DTDs by default.
Upstream issue:
https://github.com/checkstyle/checkstyle/issues/6474
https://github.com/checkstyle/checkstyle/issues/6478
Upstream patch:
https://github.com/checkstyle/checkstyle/pull/6476
References:
https://checkstyle.org/releasenotes.html#Release_8.18
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1694858] New: CVE-2019-9658 checkstyle: Loads external DTDs by default [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1694858
Bug ID: 1694858
Summary: CVE-2019-9658 checkstyle: Loads external DTDs by
default [fedora-all]
Product: Fedora
Version: 29
Status: NEW
Component: checkstyle
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: decathorpe(a)gmail.com
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, decathorpe(a)gmail.com,
edewata(a)redhat.com, greg.hellings(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, nsantos(a)redhat.com,
rob.myers(a)gtri.gatech.edu,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1684677] New: hamcrest fails to install
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1684677
Bug ID: 1684677
Summary: hamcrest fails to install
Product: Fedora
Version: rawhide
Status: NEW
Component: hamcrest
Assignee: dwalluck(a)redhat.com
Reporter: ascheel(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, dwalluck(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
Under Rawhide,
> # dnf install -y hamcrest
Will fail due to a broken package:
> Last metadata expiration check: 0:06:16 ago on Fri 01 Mar 2019 03:33:40 PM EST.
> Error:
> Problem: package hamcrest-1.3-25.fc30.noarch requires hamcrest-core = 1.3-25.fc30, but none of the providers can be installed
> - conflicting requests
> - package hamcrest-core-1.3-25.fc30.noarch is excluded
> (try to add '--skip-broken' to skip uninstallable packages)
In particular, hamcrest @ 1.3-25 depends on hamcrest-core = 1.3-25, but only
hamcrest-core = 1.3-23.module_2512+68251d4e can be provided (from the ant
module).
Version-Release number of selected component (if applicable):
hamcrest @ 1.3-25.fc30
hamcrest-core @ 1.3-23.module_2512+68251d4e
How reproducible:
Very
Steps to Reproduce:
1. Install a fresh Rawhide system
2. dnf install -y hamcrest
Actual results:
Hamcrest can't be installed.
Expected results:
Hamcrest should be installable, either directly or as part of the ant module.
The dependencies shouldn't be broken.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1703026] New: maven: please drop dependency on chkconfig
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1703026
Bug ID: 1703026
Summary: maven: please drop dependency on chkconfig
Product: Fedora
Version: 30
Status: NEW
Component: maven
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: zbyszek(a)in.waw.pl
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, jamielinux(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mhroncok(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com, sochotni(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Description of problem:
Seems to be an unused leftover but it pulls in a few unnecessary packages.
Version-Release number of selected component (if applicable):
maven-3.5.4-7.fc30.noarch
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1675352] New: maven: FTBFS in Fedora rawhide/f30
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1675352
Bug ID: 1675352
Summary: maven: FTBFS in Fedora rawhide/f30
Product: Fedora
Version: rawhide
Status: NEW
Component: maven
Assignee: extras-orphan(a)fedoraproject.org
Reporter: releng(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, extras-orphan(a)fedoraproject.org,
jamielinux(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
sochotni(a)redhat.com
Blocks: 1674516
Target Milestone: ---
Classification: Fedora
maven failed to build from source in Fedora rawhide/f30
https://koji.fedoraproject.org/koji/taskinfo?taskID=32412982
For details on the mass rebuild see:
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
Please fix maven at your earliest convenience and set the bug's status to
ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks,
maven will be orphaned. Before branching of Fedora 31,
maven will be retired, if it still fails to build.
For more details on the FTBFS policy, please visit:
https://fedoraproject.org/wiki/Fails_to_build_from_source
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1674516
[Bug 1674516] (F30FTBFS) - Fedora 30 Mass Rebuild FTBFS Tracker
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1696088] New: CVE-2018-12545 jetty: large settings frames causing denial of service [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1696088
Bug ID: 1696088
Summary: CVE-2018-12545 jetty: large settings frames causing
denial of service [fedora-all]
Product: Fedora
Version: 29
Status: NEW
Component: jetty
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: darunesh(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, krzysztof.daniel(a)gmail.com,
mizdebsk(a)redhat.com, sochotni(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1698509] New: CVE-2019-11065 gradle: Insecure HTTP URL used to download dependencies leading to possibly maliciously compromised artifacts. [fedora-28]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1698509
Bug ID: 1698509
Summary: CVE-2019-11065 gradle: Insecure HTTP URL used to
download dependencies leading to possibly maliciously
compromised artifacts. [fedora-28]
Product: Fedora
Version: 28
Status: NEW
Component: gradle
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: mrehak(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dan(a)danieljamesscott.org,
java-sig-commits(a)lists.fedoraproject.org,
jjelen(a)redhat.com, lkundrak(a)v3.sk,
mizdebsk(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-28.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1636512] CVE-2018-11784 tomcat: Open redirect in default servlet
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1636512
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1003,reported=20181003,sour |1003,reported=20181003,sour
|ce=internet,cvss3=5.3/CVSS: |ce=internet,cvss3=5.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:N/I:L/A:N,cwe=CWE-99,fed |/C:N/I:L/A:N,cwe=CWE-99,fed
|ora-all/tomcat=affected,rhs |ora-all/tomcat=affected,rhs
|cl-3/rh-java-common-tomcat= |cl-3/rh-java-common-tomcat=
|notaffected,bpms-6/tomcat=n |notaffected,bpms-6/tomcat=n
|otaffected,brms-6/tomcat=no |otaffected,brms-6/tomcat=no
|taffected,epel-all/tomcat=a |taffected,epel-all/tomcat=a
|ffected,brms-5/jbossweb=not |ffected,brms-5/jbossweb=not
|affected,eap-6/jbossweb=won |affected,eap-6/jbossweb=won
|tfix,eap-5/jbossweb=notaffe |tfix,eap-5/jbossweb=notaffe
|cted,jdg-6/jbossweb=new,jdg |cted,jdg-6/jbossweb=new,jdg
|-7/tomcat=new,jdv-6/jbosswe |-7/tomcat=new,jdv-6/jbosswe
|b=new,fuse-6/tomcat=new,fus |b=new,fuse-6/tomcat=new,fus
|e-7/tomcat=new,fsw-6/jbossw |e-7/tomcat=new,fsw-6/jbossw
|eb=new,soap-5/jbossweb=nota |eb=new,soap-5/jbossweb=nota
|ffected,springboot-1/tomcat |ffected,springboot-1/tomcat
|=new,jbews-2/tomcat6=notaff |=affected,jbews-2/tomcat6=n
|ected,rhel-7/tomcat=affecte |otaffected,rhel-7/tomcat=af
|d,jbews-2/tomcat7=wontfix,j |fected,jbews-2/tomcat7=wont
|ws-3/tomcat=affected,rhel-6 |fix,jws-3/tomcat=affected,r
|/tomcat6=notaffected,jon-3/ |hel-6/tomcat6=notaffected,j
|jbossweb=wontfix,jws-5/tomc |on-3/jbossweb=wontfix,jws-5
|at=notaffected,rhel-8/pki-d |/tomcat=notaffected,rhel-8/
|eps:10.6/pki-servlet-contai |pki-deps:10.6/pki-servlet-c
|ner=affected |ontainer=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1636512] CVE-2018-11784 tomcat: Open redirect in default servlet
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1636512
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1003,reported=20181003,sour |1003,reported=20181003,sour
|ce=internet,cvss3=5.3/CVSS: |ce=internet,cvss3=5.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:N/I:L/A:N,cwe=CWE-99,fed |/C:N/I:L/A:N,cwe=CWE-99,fed
|ora-all/tomcat=affected,rhs |ora-all/tomcat=affected,rhs
|cl-3/rh-java-common-tomcat= |cl-3/rh-java-common-tomcat=
|notaffected,bpms-6/tomcat=n |notaffected,bpms-6/tomcat=n
|otaffected,brms-6/tomcat=no |otaffected,brms-6/tomcat=no
|taffected,epel-all/tomcat=a |taffected,epel-all/tomcat=a
|ffected,brms-5/jbossweb=not |ffected,brms-5/jbossweb=not
|affected,eap-6/jbossweb=won |affected,eap-6/jbossweb=won
|tfix,eap-5/jbossweb=notaffe |tfix,eap-5/jbossweb=notaffe
|cted,jdg-6/jbossweb=new,jdg |cted,jdg-6/jbossweb=new,jdg
|-7/tomcat=new,jdv-6/jbosswe |-7/tomcat=new,jdv-6/jbosswe
|b=new,fuse-6/tomcat=new,fus |b=new,fuse-6/tomcat=new,fus
|e-7/tomcat=new,fsw-6/jbossw |e-7/tomcat=new,fsw-6/jbossw
|eb=new,soap-5/jbossweb=nota |eb=new,soap-5/jbossweb=nota
|ffected,springboot-1/tomcat |ffected,springboot-1/tomcat
|=new,jbews-2/tomcat6=notaff |=new,jbews-2/tomcat6=notaff
|ected,rhel-7/tomcat=affecte |ected,rhel-7/tomcat=affecte
|d,jbews-2/tomcat7=wontfix,j |d,jbews-2/tomcat7=wontfix,j
|ws-3/tomcat=affected,rhel-6 |ws-3/tomcat=affected,rhel-6
|/tomcat6=notaffected,jon-3/ |/tomcat6=notaffected,jon-3/
|jbossweb=new,jws-5/tomcat=n |jbossweb=wontfix,jws-5/tomc
|otaffected,rhel-8/pki-deps: |at=notaffected,rhel-8/pki-d
|10.6/pki-servlet-container= |eps:10.6/pki-servlet-contai
|affected |ner=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1636512] CVE-2018-11784 tomcat: Open redirect in default servlet
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1636512
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1003,reported=20181003,sour |1003,reported=20181003,sour
|ce=internet,cvss3=5.3/CVSS: |ce=internet,cvss3=5.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:N/I:L/A:N,cwe=CWE-99,fed |/C:N/I:L/A:N,cwe=CWE-99,fed
|ora-all/tomcat=affected,rhs |ora-all/tomcat=affected,rhs
|cl-3/rh-java-common-tomcat= |cl-3/rh-java-common-tomcat=
|notaffected,bpms-6/tomcat=n |notaffected,bpms-6/tomcat=n
|otaffected,brms-6/tomcat=no |otaffected,brms-6/tomcat=no
|taffected,epel-all/tomcat=a |taffected,epel-all/tomcat=a
|ffected,brms-5/jbossweb=not |ffected,brms-5/jbossweb=not
|affected,eap-6/jbossweb=won |affected,eap-6/jbossweb=won
|tfix,eap-5/jbossweb=notaffe |tfix,eap-5/jbossweb=notaffe
|cted,jdg-6/jbossweb=new,jdg |cted,jdg-6/jbossweb=new,jdg
|-7/tomcat=new,jdv-6/jbosswe |-7/tomcat=new,jdv-6/jbosswe
|b=new,fuse-6/tomcat=new,fus |b=new,fuse-6/tomcat=new,fus
|e-7/tomcat=new,fsw-6/jbossw |e-7/tomcat=new,fsw-6/jbossw
|eb=new,soap-5/jbossweb=nota |eb=new,soap-5/jbossweb=nota
|ffected,springboot-1/tomcat |ffected,springboot-1/tomcat
|=new,jbews-2/tomcat6=notaff |=new,jbews-2/tomcat6=notaff
|ected,jws-3/tomcat7=affecte |ected,rhel-7/tomcat=affecte
|d,rhel-7/tomcat=affected,jb |d,jbews-2/tomcat7=wontfix,j
|ews-2/tomcat7=wontfix,jws-3 |ws-3/tomcat=affected,rhel-6
|/tomcat=affected,rhel-6/tom |/tomcat6=notaffected,jon-3/
|cat6=notaffected,jon-3/jbos |jbossweb=new,jws-5/tomcat=n
|sweb=new,jws-5/tomcat=notaf |otaffected,rhel-8/pki-deps:
|fected,rhel-8/pki-deps:10.6 |10.6/pki-servlet-container=
|/pki-servlet-container=affe |affected
|cted |
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month