[Bug 1902827] New: CVE-2020-27218 jetty: buffer not correctly recycled in Gzip Request inflation [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1902827
Bug ID: 1902827
Summary: CVE-2020-27218 jetty: buffer not correctly recycled in
Gzip Request inflation [fedora-all]
Product: Fedora
Version: 33
Status: NEW
Component: jetty
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: mat.booth(a)redhat.com
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, krzysztof.daniel(a)gmail.com,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
sochotni(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years
[Bug 1837444] New: CVE-2020-1945 ant: insecure temporary file vulnerability
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1837444
Bug ID: 1837444
Summary: CVE-2020-1945 ant: insecure temporary file
vulnerability
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
bmontgom(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com,
dkreling(a)redhat.com, dmoluguw(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, gvarsami(a)redhat.com,
hvyas(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
jaromir.capik(a)email.cz, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jburrell(a)redhat.com,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, mizdebsk(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msrb(a)redhat.com, msvehla(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pcheung(a)redhat.com,
pdrozd(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puebele(a)redhat.com, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
smaestri(a)redhat.com, spinder(a)redhat.com,
sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tcunning(a)redhat.com, theute(a)redhat.com,
tkirby(a)redhat.com, tom.jenkinson(a)redhat.com,
vbellur(a)redhat.com, vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary
directory identified by the Java system property java.io.tmpdir for several
tasks and may thus leak sensitive information. The fixcrlf and replaceregexp
tasks also copy files from the temporary directory back into the build tree
allowing an attacker to inject modified source files into the build process.
References:
https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plu...
https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1847093] New: antrl3 mock build requires antrl3-tools, which is built by... antlr3.
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1847093
Bug ID: 1847093
Summary: antrl3 mock build requires antrl3-tools, which is
built by... antlr3.
Product: Fedora
Version: 32
Status: NEW
Component: antlr3
Severity: high
Assignee: loganjerry(a)gmail.com
Reporter: gilboad(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dingyichen(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
loganjerry(a)gmail.com, mizdebsk(a)redhat.com,
walters(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
I'm trying to build antrl3 under CentOS 8.
While trying to slowly build the dependency chain I noticed a BuildRequires:
mvn(org.antlr:antlr3-maven-plugin) which is met by installing (under Fedora 32)
antlr3-tools.
Checking the source of antrl3-tools, I noticed its being built by
antlr3.src.rpm.
BTW, the same issue can be found in stringtemplate4, which is required by
antlr3 build, but itself requires antrl3-tools.
Version-Release number of selected component (if applicable):
antlr3-3.5.2-25.fc32.src.rpm
How reproducible:
Always.
Packages:
A. antlr3:
$ mock -r fedora-32-x86_64 antlr3-3.5.2-27.fc32.src.rpm
...
Installing:
ant noarch 1.10.8-1.fc32
updates 164 k
<--------------------------------------------------------->
antlr3-tool noarch 1:3.5.2-27.fc32
updates 1.1 M
<--------------------------------------------------------->
autoconf noarch 2.69-33.fc32
fedora 666 k
automake noarch 1.16.1-14.fc32
fedora 665 k
doxygen x86_64 1:1.8.17-2.fc32
fedora 4.8 M
graphviz x86_64 2.42.4-1.fc32
fedora 3.4 M
libtool x86_64 2.4.6-33.fc32
fedora 579 k
maven-lib noarch 1:3.6.1-5.fc32
fedora 1.4 M
maven-local noarch 5.3.0-9.fc32
fedora 8.7 k
maven-plugin-bundle noarch 3.5.1-4.fc32
fedora 201 k
maven-plugin-plugin noarch 3.5.1-7.fc32
fedora 61 k
maven-project noarch 2.2.1-63.fc32
fedora 155 k
plexus-compiler noarch 2.8.5-2.fc32
fedora 65 k
sonatype-oss-parent noarch 7-19.fc32
fedora 13 k
stringtemplate noarch 3.2.1-21.fc32
fedora 134 k
<--------------------------------------------------------->
stringtemplate4 noarch 4.3-2.fc32
fedora 247 k
<--------------------------------------------------------->
...
Wrote: /builddir/build/RPMS/antlr3-java-3.5.2-27.fc32.noarch.rpm
Wrote: /builddir/build/RPMS/antlr3-C-3.4-3.5.2.27.fc32.x86_64.rpm
Wrote: /builddir/build/RPMS/antlr3-javascript-3.1-3.5.2.27.fc32.noarch.rpm
Wrote: /builddir/build/RPMS/antlr3-C-debuginfo-3.4-3.5.2.27.fc32.x86_64.rpm
Wrote: /builddir/build/RPMS/antlr3-C++-devel-3.5.2-27.fc32.x86_64.rpm
<--------------------------------------------------------->
Wrote: /builddir/build/RPMS/antlr3-tool-3.5.2-27.fc32.noarch.rpm
<--------------------------------------------------------->
Wrote: /builddir/build/RPMS/antlr3-C-devel-3.4-3.5.2.27.fc32.x86_64.rpm
Wrote: /builddir/build/RPMS/antlr3-debugsource-3.5.2-27.fc32.x86_64.rpm
B. stringtemplate4:
$ mock -r fedora-32-x86_64 stringtemplate4-4.3-2.fc32.src.rpm
...
Installing:
antlr3-java noarch 1:3.5.2-27.fc32
updates 160 k
<--------------------------------------------------------->
antlr3-tool noarch 1:3.5.2-27.fc32
updates 1.1 M
<--------------------------------------------------------->
junit noarch 1:4.12-13.fc32
fedora 283 k
maven-local noarch 5.3.0-9.fc32
fedora 8.7 k
sonatype-oss-parent noarch 7-19.fc32
fedora 13 k
xorg-x11-fonts-Type1 noarch 7.5-24.fc32
fedora 500 k
xorg-x11-server-Xvfb x86_64 1.20.8-1.fc32
fedora 879 k
...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1758171] New: jackson-databind: Serialization gadgets in classes of the commons-configuration package
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1758171
Bug ID: 1758171
Summary: jackson-databind: Serialization gadgets in classes of
the commons-configuration package
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cbyrne(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, cmacedo(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
decathorpe(a)gmail.com, dffrench(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
drusso(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, ganandan(a)redhat.com,
ggaughan(a)redhat.com, hhorak(a)redhat.com,
hhudgeon(a)redhat.com, ibek(a)redhat.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jjoyce(a)redhat.com,
jmadigan(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lthon(a)redhat.com, lzap(a)redhat.com,
mat.booth(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, mmccune(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
ngough(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, pwright(a)redhat.com,
rchan(a)redhat.com, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rjerrido(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
sclewis(a)redhat.com, scohen(a)redhat.com,
sdaley(a)redhat.com, slinaber(a)redhat.com,
smaestri(a)redhat.com, sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com,
trepel(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
A flaw was found in jackson-databind before 2.9.10. New serialization gadgets
were found regarding a class of the commons-configuration 1 and
commons-configuration 2 packages which may help in exploiting deserialization
issues.
Upstream issue:
https://github.com/FasterXML/jackson-databind/issues/2462
Upstream patch:
https://github.com/FasterXML/jackson-databind/commit/41b7f9b90149e9d44a65...
https://github.com/FasterXML/jackson-databind/commit/819cdbcab51c6da9fb89...
References:
https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1755831] New: CVE-2019-16335 jackson-databind: polymorphic typing issue related to com.zaxxer.hikari.HikariDataSource
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1755831
Bug ID: 1755831
Summary: CVE-2019-16335 jackson-databind: polymorphic typing
issue related to com.zaxxer.hikari.HikariDataSource
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: ahardin(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
ataylor(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bbuckingham(a)redhat.com,
bcourt(a)redhat.com, bgeorges(a)redhat.com,
bkearney(a)redhat.com, bleanhar(a)redhat.com,
bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com,
btotty(a)redhat.com, cbyrne(a)redhat.com,
ccoleman(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, cmacedo(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
decathorpe(a)gmail.com, dedgar(a)redhat.com,
dffrench(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, drusso(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
hhorak(a)redhat.com, hhudgeon(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jgoulding(a)redhat.com, jjoyce(a)redhat.com,
jmadigan(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lthon(a)redhat.com, lzap(a)redhat.com,
mat.booth(a)redhat.com, mburns(a)redhat.com,
mchappel(a)redhat.com, mkolesni(a)redhat.com,
mmccune(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, ngough(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pdrozd(a)redhat.com,
pgallagh(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
pwright(a)redhat.com, rchan(a)redhat.com,
rguimara(a)redhat.com, rhcs-maint(a)redhat.com,
rjerrido(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com,
trepel(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before
2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a
different vulnerability than CVE-2019-14540.
Reference:
https://github.com/FasterXML/jackson-databind/issues/2449
https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647...
https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1758167] New: jackson-databind: Serialization gadgets in classes of the ehcache package
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1758167
Bug ID: 1758167
Summary: jackson-databind: Serialization gadgets in classes of
the ehcache package
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cbyrne(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, cmacedo(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
decathorpe(a)gmail.com, dffrench(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
drusso(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, ganandan(a)redhat.com,
ggaughan(a)redhat.com, hhorak(a)redhat.com,
hhudgeon(a)redhat.com, ibek(a)redhat.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jjoyce(a)redhat.com,
jmadigan(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lthon(a)redhat.com, lzap(a)redhat.com,
mat.booth(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, mmccune(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
ngough(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, pwright(a)redhat.com,
rchan(a)redhat.com, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rjerrido(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
sclewis(a)redhat.com, scohen(a)redhat.com,
sdaley(a)redhat.com, slinaber(a)redhat.com,
smaestri(a)redhat.com, sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com,
trepel(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
A flaw was found in jackson-databind before 2.9.10. New serialization gadgets
were found regarding a class of the ehcache package which may help in
deserialization issues exploit.
Upstream issue:
https://github.com/FasterXML/jackson-databind/issues/2460
Upstream patch:
https://github.com/FasterXML/jackson-databind/commit/191a4cdf87b56d2ddddb...
References:
https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1775293] New: cve jackson-databind: default typing leads to code execution
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1775293
Bug ID: 1775293
Summary: cve jackson-databind: default typing leads to code
execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
ataylor(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bbuckingham(a)redhat.com,
bcourt(a)redhat.com, bgeorges(a)redhat.com,
bkearney(a)redhat.com, bmaxwell(a)redhat.com,
bmontgom(a)redhat.com, brian.stansberry(a)redhat.com,
btotty(a)redhat.com, cbyrne(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmacedo(a)redhat.com, darran.lofthouse(a)redhat.com,
decathorpe(a)gmail.com, dffrench(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, drusso(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
hhorak(a)redhat.com, hhudgeon(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jmadigan(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lef(a)fedoraproject.org, lgao(a)redhat.com,
lthon(a)redhat.com, lzap(a)redhat.com,
mat.booth(a)redhat.com, mmccune(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
ngough(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, pwright(a)redhat.com,
rchan(a)redhat.com, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rjerrido(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
sdaley(a)redhat.com, smaestri(a)redhat.com,
sokeeffe(a)redhat.com, sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com,
trepel(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com
Target Milestone: ---
Classification: Other
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0
through 2.9.10. When Default Typing is enabled (either globally or for a
specific property) for an externally exposed JSON endpoint and the service has
the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker
can provide a JNDI service to access, it is possible to make the service
execute a malicious payload.
Reference:
https://github.com/FasterXML/jackson-databind/issues/2498
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1847573] New: Please provide antlr3 version for EPEL8
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1847573
Bug ID: 1847573
Summary: Please provide antlr3 version for EPEL8
Product: Fedora EPEL
Version: epel8
Status: NEW
Component: antlr3
Assignee: dingyichen(a)gmail.com
Reporter: minfrin(a)sharp.fm
QA Contact: extras-qa(a)fedoraproject.org
CC: dingyichen(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
loganjerry(a)gmail.com, mizdebsk(a)redhat.com,
walters(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
Version not available for EPEL8.
Version-Release number of selected component (if applicable):
None.
How reproducible:
Always.
Steps to Reproduce:
1. dnf install antlr3-C-devel
Actual results:
Error: Unable to find a match: antlr3-C-devel
Expected results:
Package installed.
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month