[Bug 1684556] New: CVE-2019-1003024 CVE-2019-1003024 jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1320)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1684556
Bug ID: 1684556
Summary: CVE-2019-1003024 CVE-2019-1003024
jenkins-plugin-script-security: Sandbox Bypass in
Script Security Plugin (SECURITY-1320)
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=important,public=20190219,reported=20190219,sou
rce=internet,cvss3=8.8/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:
U/C:H/I:H/A:H,cwe=CWE-96,openshift-enterprise-3.2/jenk
ins-plugin-script-security=wontfix,openshift-enterpris
e-3.3/jenkins-plugin-script-security=wontfix,openshift
-enterprise-3.4/jenkins-plugin-script-security=wontfix
,openshift-enterprise-3.5/jenkins-plugin-script-securi
ty=wontfix,openshift-enterprise-3.7/jenkins-plugin-scr
ipt-security=wontfix,openshift-enterprise-3.6/jenkins-
plugin-script-security=wontfix,openshift-enterprise-3.
9/jenkins-plugin-script-security=wontfix,openshift-ent
erprise-3.10/jenkins-plugin-script-security=wontfix,op
enshift-enterprise-3.11/jenkins-2-plugins=affected,fed
ora-all/jenkins-script-security-plugin=affected,opensh
ift-enterprise-4.0/jenkins-2-plugins=affected
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: ahardin(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
eparis(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Target Milestone: ---
Classification: Other
The previously implemented script security sandbox protections prohibiting the
use of unsafe AST transforming annotations such as @Grab (2019-01-08 fix for
SECURITY-1266) could be circumvented through use of various Groovy language
features:
* Use of AnnotationCollector
* Import aliasing
* Referencing annotation types using their full class name
This allowed users with Overall/Read permission, or the ability to control
Jenkinsfile or sandboxed Pipeline shared library contents in SCM, to bypass the
sandbox protection and execute arbitrary code on the Jenkins master.
Using AnnotationCollector is now newly prohibited in sandboxed scripts such as
Pipelines. Importing any of the annotations considered unsafe will now result
in an error. During the compilation phase, both simple and full class names of
prohibited annotations are rejected for element annotations.
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years
[Bug 1696012] New: CVE-2019-0222 activemq: Corrupt MQTT frame can cause broker shutdown
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1696012
Bug ID: 1696012
Summary: CVE-2019-0222 activemq: Corrupt MQTT frame can cause
broker shutdown
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190327,reported=20190327,sour
ce=cve,cvss3=5.9/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/
I:N/A:H,fedora-all/activemq=affected,jbds-11/activemq=
new,amq-6/activemq=new,jdg-7/activemq-artemis=new,eap-
7/activemq-artemis=new,fsw-6/activemq=new,fuse-6/activ
emq=new,rhdm-7/activemq-artemis=new,fuse-7/activemq=ne
w,rhpam-7/activemq-artemis=new,rhev-m-4/eap7-activemq-
artemis=new,rhsso-7/activemq-artemis=new
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: agrimm(a)gmail.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, anstephe(a)redhat.com,
bmaxwell(a)redhat.com, bmcclain(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dblechte(a)redhat.com, dfediuck(a)redhat.com,
dimitris(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, eedri(a)redhat.com,
etirelli(a)redhat.com, gvarsami(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jshepherd(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lpetrovi(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rnetuka(a)redhat.com, rrajasek(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
sbonazzo(a)redhat.com, sdaley(a)redhat.com,
sherold(a)redhat.com, s(a)shk.io, sthorger(a)redhat.com,
tcunning(a)redhat.com, tdawson(a)redhat.com,
tkirby(a)redhat.com, twalsh(a)redhat.com,
vtunka(a)redhat.com
Target Milestone: ---
Classification: Other
In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to
broker Out of Memory exception making it unresponsive.
References:
http://activemq.apache.org/security-advisories.data/CVE-2019-0222-announc...
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years
[Bug 1705993] New: CVE-2019-10247 jetty: error path information disclosure
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1705993
Bug ID: 1705993
Summary: CVE-2019-10247 jetty: error path information
disclosure
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190418,reported=20190423,sour
ce=cve,cvss3=5.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/
I:N/A:N,cwe=CWE-200,fedora-all/jetty=affected,fuse-6/j
etty=new,fuse-7/jetty=new,rhn_satellite_5/jetty=new,rh
scl-3/rh-java-common-jetty=new,rhel-6/jetty-eclipse=ne
w,rhel-7/jetty=new
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: aileenc(a)redhat.com, bkearney(a)redhat.com,
chazlett(a)redhat.com, decathorpe(a)gmail.com,
eclipse-sig(a)lists.fedoraproject.org,
ggainey(a)redhat.com, hhorak(a)redhat.com,
janstey(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, jochrist(a)redhat.com,
jorton(a)redhat.com, krzysztof.daniel(a)gmail.com,
mizdebsk(a)redhat.com, sochotni(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
tlestach(a)redhat.com
Target Milestone: ---
Classification: Other
In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and
9.4.16 and older, the server running on any OS and Jetty version combination
will reveal the configured fully qualified directory base resource location on
the output of the 404 error for not finding a Context that matches the
requested path. The default server behavior on jetty-distribution and
jetty-home will include at the end of the Handler tree a DefaultHandler, which
is responsible for reporting this 404 error, it presents the various configured
contexts as HTML for users to click through to. This produced HTML includes
output that contains the configured fully qualified directory base resource
location for each context.
Reference:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546577
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years
[Bug 1705924] New: CVE-2019-10241 jetty: using specially formatted URL against DefaultServlet or ResourceHandler leads to XSS conditions
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1705924
Bug ID: 1705924
Summary: CVE-2019-10241 jetty: using specially formatted URL
against DefaultServlet or ResourceHandler leads to XSS
conditions
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190422,reported=20190423,sour
ce=cve,cvss3=4.7/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/
I:L/A:N,cwe=CWE-79,fedora-all/jetty=affected,rhel-6/je
tty-eclipse=new,rhel-7/jetty=new,fuse-6/jetty=new,fuse
-7/jetty=new,rhn_satellite_5/jetty=new,rhscl-3/rh-java
-common-jetty=new
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mrehak(a)redhat.com
CC: aileenc(a)redhat.com, bkearney(a)redhat.com,
chazlett(a)redhat.com, decathorpe(a)gmail.com,
eclipse-sig(a)lists.fedoraproject.org,
ggainey(a)redhat.com, hhorak(a)redhat.com,
janstey(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, jochrist(a)redhat.com,
jorton(a)redhat.com, krzysztof.daniel(a)gmail.com,
mizdebsk(a)redhat.com, sochotni(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
tlestach(a)redhat.com
Target Milestone: ---
Classification: Other
In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and
older, the server is vulnerable to XSS conditions if a remote client USES a
specially formatted URL against the DefaultServlet or ResourceHandler that is
configured for showing a Listing of directory contents.
External References:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=546121
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years
[Bug 1709860] New: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1709860
Bug ID: 1709860
Summary: CVE-2019-5427 c3p0: loading XML configuration leads to
denial of service
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190417,reported=20190424,sour
ce=cve,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/
I:N/A:H,cwe=CWE-776,fedora-all/c3p0=affected,epel-7/c3
p0=affected,rhes-3/c3p0=new,rhpam-7/c3p0=new,fuse-6/c3
p0=new,fuse-7/c3p0=new,rhn_satellite_6/c3p0=new,jbews-
2/c3p0=new,rhn_satellite_5/c3p0=new,rhmap-4/c3p0=new,v
ertx-3/c3p0=new,soap-5/c3p0=new,bpms-6/c3p0=new
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: msiddiqu(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, avibelli(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
btotty(a)redhat.com, cbyrne(a)redhat.com,
chazlett(a)redhat.com, cmacedo(a)redhat.com,
csutherl(a)redhat.com, decathorpe(a)gmail.com,
dffrench(a)redhat.com, dingyichen(a)gmail.com,
drusso(a)redhat.com, etirelli(a)redhat.com,
ggainey(a)redhat.com, gvarsami(a)redhat.com,
gzaronik(a)redhat.com, hhudgeon(a)redhat.com,
ibek(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jbalunas(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jmadigan(a)redhat.com,
jochrist(a)redhat.com, jpallich(a)redhat.com,
jshepherd(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lpetrovi(a)redhat.com,
lthon(a)redhat.com, mat.booth(a)redhat.com,
mbabacek(a)redhat.com, mmccune(a)redhat.com,
mnovotny(a)redhat.com, mszynkie(a)redhat.com,
myarboro(a)redhat.com, ngough(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, ppenicka(a)redhat.com,
pwright(a)redhat.com, rchan(a)redhat.com,
rjerrido(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
sisharma(a)redhat.com, smohan(a)redhat.com,
ssaha(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, trepel(a)redhat.com,
trogers(a)redhat.com, twalsh(a)redhat.com,
vbellur(a)redhat.com, weli(a)redhat.com
Target Milestone: ---
Classification: Other
c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading
XML configuration due to missing protections against recursive entity expansion
when loading configuration.
References:
https://hackerone.com/reports/509315
http://www.cvedetails.com/cve/CVE-2019-5427/
Upstream commit:
https://github.com/swaldman/c3p0/commit/f38f27635c384806c2a9d6500d80183d9...
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month