[Bug 1636512] CVE-2018-11784 tomcat: Open redirect in default servlet
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1636512
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1003,reported=20181003,sour |1003,reported=20181003,sour
|ce=internet,cvss3=5.3/CVSS: |ce=internet,cvss3=5.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:N/I:L/A:N,cwe=CWE-99,fed |/C:N/I:L/A:N,cwe=CWE-99,fed
|ora-all/tomcat=affected,rhs |ora-all/tomcat=affected,rhs
|cl-3/rh-java-common-tomcat= |cl-3/rh-java-common-tomcat=
|notaffected,bpms-6/tomcat=n |notaffected,bpms-6/tomcat=n
|otaffected,brms-6/tomcat=no |otaffected,brms-6/tomcat=no
|taffected,epel-all/tomcat=a |taffected,epel-all/tomcat=a
|ffected,brms-5/jbossweb=not |ffected,brms-5/jbossweb=not
|affected,eap-6/jbossweb=won |affected,eap-6/jbossweb=won
|tfix,eap-5/jbossweb=notaffe |tfix,eap-5/jbossweb=notaffe
|cted,jdg-6/jbossweb=new,jdg |cted,jdg-6/jbossweb=new,jdg
|-7/tomcat=new,jdv-6/jbosswe |-7/tomcat=new,jdv-6/jbosswe
|b=new,fuse-6/tomcat=new,fus |b=new,fuse-6/tomcat=new,fus
|e-7/tomcat=new,fsw-6/jbossw |e-7/tomcat=new,fsw-6/jbossw
|eb=new,soap-5/jbossweb=nota |eb=new,soap-5/jbossweb=nota
|ffected,springboot-1/tomcat |ffected,springboot-1/tomcat
|=new,jbews-2/tomcat6=notaff |=new,jbews-2/tomcat6=notaff
|ected,jws-3/tomcat7=affecte |ected,jws-3/tomcat7=affecte
|d,rhel-7/tomcat=affected,jb |d,rhel-7/tomcat=affected,jb
|ews-2/tomcat7=wontfix,jws-3 |ews-2/tomcat7=wontfix,jws-3
|/tomcat8=affected,rhel-6/to |/tomcat=affected,rhel-6/tom
|mcat6=notaffected,jon-3/jbo |cat6=notaffected,jon-3/jbos
|ssweb=new,jws-5/tomcat=nota |sweb=new,jws-5/tomcat=notaf
|ffected,rhel-8/pki-deps:10. |fected,rhel-8/pki-deps:10.6
|6/pki-servlet-container=aff |/pki-servlet-container=affe
|ected |cted
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1636512] CVE-2018-11784 tomcat: Open redirect in default servlet
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1636512
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1003,reported=20181003,sour |1003,reported=20181003,sour
|ce=internet,cvss3=5.3/CVSS: |ce=internet,cvss3=5.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:N/I:L/A:N,cwe=CWE-99,fed |/C:N/I:L/A:N,cwe=CWE-99,fed
|ora-all/tomcat=affected,rhs |ora-all/tomcat=affected,rhs
|cl-3/rh-java-common-tomcat= |cl-3/rh-java-common-tomcat=
|notaffected,bpms-6/tomcat=n |notaffected,bpms-6/tomcat=n
|ew,brms-6/tomcat=new,epel-a |otaffected,brms-6/tomcat=no
|ll/tomcat=affected,brms-5/j |taffected,epel-all/tomcat=a
|bossweb=new,eap-6/jbossweb= |ffected,brms-5/jbossweb=not
|new,eap-5/jbossweb=new,jdg- |affected,eap-6/jbossweb=won
|6/jbossweb=new,jdg-7/tomcat |tfix,eap-5/jbossweb=notaffe
|=new,jdv-6/jbossweb=new,fus |cted,jdg-6/jbossweb=new,jdg
|e-6/tomcat=new,fuse-7/tomca |-7/tomcat=new,jdv-6/jbosswe
|t=new,fsw-6/jbossweb=new,so |b=new,fuse-6/tomcat=new,fus
|ap-5/jbossweb=new,springboo |e-7/tomcat=new,fsw-6/jbossw
|t-1/tomcat=new,jbews-2/tomc |eb=new,soap-5/jbossweb=nota
|at6=notaffected,jws-3/tomca |ffected,springboot-1/tomcat
|t7=affected,rhel-7/tomcat=a |=new,jbews-2/tomcat6=notaff
|ffected,jbews-2/tomcat7=won |ected,jws-3/tomcat7=affecte
|tfix,jws-3/tomcat8=affected |d,rhel-7/tomcat=affected,jb
|,rhel-6/tomcat6=notaffected |ews-2/tomcat7=wontfix,jws-3
|,jon-3/jbossweb=new,jws-5/t |/tomcat8=affected,rhel-6/to
|omcat=notaffected,rhel-8/pk |mcat6=notaffected,jon-3/jbo
|i-deps:10.6/pki-servlet-con |ssweb=new,jws-5/tomcat=nota
|tainer=affected |ffected,rhel-8/pki-deps:10.
| |6/pki-servlet-container=aff
| |ected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month
[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1528565
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71212,reported=20171206,sou |71212,reported=20171206,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,eap-6/reste |S:U/C:H/I:H/A:H,eap-6/reste
|asy=affected,fedora-all/jac |asy=affected,fedora-all/jac
|kson-databind=affected,jdg- |kson-databind=affected,jdg-
|7/jackson-databind=notaffec |7/jackson-databind=notaffec
|ted,jon-3/resteasy=affected |ted,jon-3/resteasy=affected
|,openshift-enterprise-2/jac |,openshift-enterprise-2/jac
|kson-databind=affected,dts- |kson-databind=affected,dts-
|4/devtoolset-4-jackson-data |4/devtoolset-4-jackson-data
|bind=wontfix,rhev-m-3/jaspe |bind=wontfix,rhev-m-3/jaspe
|rreports-server-pro=wontfix |rreports-server-pro=wontfix
|,rhev-m-4/eap7-jackson-data |,rhev-m-4/eap7-jackson-data
|bind=affected,amq-6/jackson |bind=affected,amq-6/jackson
|-databind=notaffected,bpms- |-databind=notaffected,bpms-
|6/jackson-databind=affected |6/jackson-databind=affected
|,jdv-6/jackson-databind=not |,jdv-6/jackson-databind=not
|affected,fuse-6/jackson-dat |affected,fuse-6/jackson-dat
|abind=notaffected,rhmap-4/j |abind=notaffected,rhmap-4/j
|ackson-databind=notaffected |ackson-databind=notaffected
|,rhn_satellite_6/jackson-da |,rhn_satellite_6/jackson-da
|tabind=new,rhscl-3/rh-eclip |tabind=new,rhscl-3/rh-eclip
|se46-jackson-databind=affec |se46-jackson-databind=affec
|ted,rhscl-3/rh-maven35-jack |ted,rhscl-3/rh-maven35-jack
|son-databind=affected,sam-1 |son-databind=affected,sam-1
|/jackson-databind=wontfix,e |/jackson-databind=wontfix,e
|ap-7/resteasy=affected,brms |ap-7/resteasy=affected,brms
|-6/jackson-databind=affecte |-6/jackson-databind=affecte
|d,swarm-7/jackson-databind= |d,swarm-7/jackson-databind=
|notaffected,vertx-3/jackson |affected,vertx-3/jackson-da
|-databind=notaffected |tabind=notaffected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 1 month