[Bug 1607591] CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|80722,reported=20180723,sou |80722,reported=20180723,sou
|rce=internet,cvss3=7.5/CVSS |rce=internet,cvss3=7.5/CVSS
|:3.0/AV:N/AC:L/PR:N/UI:N/S: |:3.0/AV:N/AC:L/PR:N/UI:N/S:
|U/C:N/I:N/A:H,fedora-all/to |U/C:N/I:N/A:H,fedora-all/to
|mcat=affected,rhscl-3/rh-ja |mcat=affected,rhscl-3/rh-ja
|va-common-tomcat=notaffecte |va-common-tomcat=notaffecte
|d,bpms-6/tomcat=notaffected |d,bpms-6/tomcat=notaffected
|,brms-6/tomcat=notaffected, |,brms-6/tomcat=notaffected,
|epel-all/tomcat=affected,br |epel-all/tomcat=affected,br
|ms-5/jbossweb=notaffected,e |ms-5/jbossweb=notaffected,e
|ap-6/jbossweb=affected,eap- |ap-6/jbossweb=affected,eap-
|5/jbossweb=notaffected,jdg- |5/jbossweb=notaffected,jdg-
|6/jbossweb=notaffected,jdg- |6/jbossweb=notaffected,jdg-
|7/tomcat=notaffected,jdv-6/ |7/tomcat=notaffected,jdv-6/
|jbossweb=affected,fuse-6/to |jbossweb=affected,fuse-6/to
|mcat=affected,fuse-7/tomcat |mcat=affected,fuse-7/tomcat
|=affected,fsw-6/jbossweb=af |=affected,fsw-6/jbossweb=af
|fected,soap-5/jbossweb=nota |fected,soap-5/jbossweb=nota
|ffected,springboot-1/tomcat |ffected,springboot-1/tomcat
|=affected,jbews-2/tomcat6=n |=affected,jbews-2/tomcat6=n
|otaffected,jws-3/tomcat7=af |otaffected,jws-3/tomcat7=af
|fected,rhel-7/tomcat=affect |fected,rhel-7/tomcat=affect
|ed,jbews-2/tomcat7=wontfix, |ed,jbews-2/tomcat7=wontfix,
|jws-3/tomcat8=affected,rhel |jws-3/tomcat8=affected,rhel
|-6/tomcat6=notaffected,jon- |-6/tomcat6=notaffected,jon-
|3/jbossweb=affected,jws-5/t |3/jbossweb=affected,jws-5/t
|omcat=notaffected |omcat=notaffected,amq-7/tom
| |cat=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1564408] CVE-2018-1272 spring-framework: Multipart content pollution
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1564408
Joshua Padman <jpadman(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=low,public=20180405, |impact=low,public=20180405,
|reported=20180405,source=in |reported=20180405,source=in
|ternet,cvss3=5.3/CVSS:3.0/A |ternet,cvss3=5.3/CVSS:3.0/A
|V:N/AC:H/PR:L/UI:N/S:U/C:N/ |V:N/AC:H/PR:L/UI:N/S:U/C:N/
|I:H/A:N,cwe=CWE-88,fedora-a |I:H/A:N,cwe=CWE-88,fedora-a
|ll/springframework=affected |ll/springframework=affected
|,rhel-8/springframework=not |,rhel-8/springframework=not
|affected,fsw-6/spring=wontf |affected,fsw-6/spring=wontf
|ix,fuse-6/spring=wontfix,jd |ix,fuse-6/spring=wontfix,jd
|v-6/spring=wontfix,brms-5/s |v-6/spring=wontfix,brms-5/s
|pring=wontfix,soap-5/spring |pring=wontfix,soap-5/spring
|=wontfix,openstack-9/openda |=wontfix,openstack-9/openda
|ylight=new,openstack-10/ope |ylight=wontfix,openstack-10
|ndaylight=new,openstack-11/ |/opendaylight=wontfix,opens
|opendaylight=new,openstack- |tack-11/opendaylight=wontfi
|12/opendaylight=new,rhes-3/ |x,openstack-12/opendaylight
|rhevm-dependencies=wontfix, |=wontfix,rhes-3/rhevm-depen
|amq-6/spring=wontfix,eap-5/ |dencies=wontfix,amq-6/sprin
|jbossweb=wontfix,eap-7/unde |g=wontfix,eap-5/jbossweb=wo
|rtow=notaffected,eap-6/jbos |ntfix,eap-7/undertow=notaff
|sweb=notaffected,jpp-6/spri |ected,eap-6/jbossweb=notaff
|ng=notaffected,jbews-2/tomc |ected,jpp-6/spring=notaffec
|at=notaffected,jws-3/tomcat |ted,jbews-2/tomcat=notaffec
|=notaffected,rhmap-4/spring |ted,jws-3/tomcat=notaffecte
|=new,fis-2/spring=affected, |d,rhmap-4/spring=new,fis-2/
|fuse-7/spring-web=affected |spring=affected,fuse-7/spri
| |ng-web=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1639090] CVE-2018-11796 tika: Incomplete fix allows for XML entity expansion resulting in denial of service
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1639090
Andrej Nemec <anemec(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |abergmann(a)suse.com,
| |aileenc(a)redhat.com,
| |alazarot(a)redhat.com,
| |anstephe(a)redhat.com,
| |bkearney(a)redhat.com,
| |chazlett(a)redhat.com,
| |drieden(a)redhat.com,
| |etirelli(a)redhat.com,
| |ggainey(a)redhat.com,
| |gvarsami(a)redhat.com,
| |hhorak(a)redhat.com,
| |ibek(a)redhat.com,
| |java-sig-commits(a)lists.fedo
| |raproject.org,
| |jcoleman(a)redhat.com,
| |jolee(a)redhat.com,
| |jorton(a)redhat.com,
| |jschatte(a)redhat.com,
| |jstastny(a)redhat.com,
| |kconner(a)redhat.com,
| |krathod(a)redhat.com,
| |kverlaen(a)redhat.com,
| |ldimaggi(a)redhat.com,
| |lef(a)fedoraproject.org,
| |lpetrovi(a)redhat.com,
| |mat.booth(a)redhat.com,
| |meissner(a)suse.de,
| |nwallace(a)redhat.com,
| |paradhya(a)redhat.com,
| |pszubiak(a)redhat.com
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1540000] CVE-2018-1294 apache-commons-email: Improper validation in Email.setBounceAddress() can allow for email modification
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1540000
Pedro Sampaio <psampaio(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|0126,reported=20180130,sour |0126,reported=20180130,sour
|ce=oss-security,cvss3=5.4/C |ce=oss-security,cvss3=5.4/C
|VSS:3.0/AV:N/AC:L/PR:L/UI:N |VSS:3.0/AV:N/AC:L/PR:L/UI:N
|/S:U/C:L/I:L/A:N,cwe=CWE-20 |/S:U/C:L/I:L/A:N,cwe=CWE-20
|,fedora-all/apache-commons- |,fedora-all/apache-commons-
|email=affected,rhel-8/apach |email=affected
|e-commons-email=new |
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years
[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1528565
Kunjan Rathod <krathod(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|71212,reported=20171206,sou |71212,reported=20171206,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,eap-6/reste |S:U/C:H/I:H/A:H,eap-6/reste
|asy=affected,fedora-all/jac |asy=affected,fedora-all/jac
|kson-databind=affected,jdg- |kson-databind=affected,jdg-
|7/jackson-databind=notaffec |7/jackson-databind=notaffec
|ted,jon-3/resteasy=affected |ted,jon-3/resteasy=affected
|,openshift-enterprise-2/jac |,openshift-enterprise-2/jac
|kson-databind=affected,dts- |kson-databind=affected,dts-
|4/devtoolset-4-jackson-data |4/devtoolset-4-jackson-data
|bind=wontfix,rhev-m-3/jaspe |bind=wontfix,rhev-m-3/jaspe
|rreports-server-pro=wontfix |rreports-server-pro=wontfix
|,rhev-m-4/eap7-jackson-data |,rhev-m-4/eap7-jackson-data
|bind=affected,amq-6/jackson |bind=affected,amq-6/jackson
|-databind=notaffected,bpms- |-databind=notaffected,bpms-
|6/jackson-databind=new,jdv- |6/jackson-databind=new,jdv-
|6/jackson-databind=notaffec |6/jackson-databind=notaffec
|ted,fuse-6/jackson-databind |ted,fuse-6/jackson-databind
|=notaffected,rhmap-4/jackso |=notaffected,rhmap-4/jackso
|n-databind=notaffected,rhn_ |n-databind=notaffected,rhn_
|satellite_6/jackson-databin |satellite_6/jackson-databin
|d=new,rhscl-3/rh-eclipse46- |d=new,rhscl-3/rh-eclipse46-
|jackson-databind=affected,r |jackson-databind=affected,r
|hscl-3/rh-maven35-jackson-d |hscl-3/rh-maven35-jackson-d
|atabind=affected,sam-1/jack |atabind=affected,sam-1/jack
|son-databind=wontfix,eap-7/ |son-databind=wontfix,eap-7/
|resteasy=affected,brms-6/ja |resteasy=affected,brms-6/ja
|ckson-databind=new,swarm-7/ |ckson-databind=new,swarm-7/
|jackson-databind=affected,v |jackson-databind=notaffecte
|ertx-3/jackson-databind=not |d,vertx-3/jackson-databind=
|affected |notaffected
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years