[Bug 1774727] New: CVE-2019-12422 shiro: Cookie padding oracle vulnerability with default configuration [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1774727
Bug ID: 1774727
Summary: CVE-2019-12422 shiro: Cookie padding oracle
vulnerability with default configuration [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: shiro
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1799477] New: CVE-2020-5398 springframework: RFD attack via Content-Disposition Header sourced from request input by Spring MVC or Spring WebFlux Application [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1799477
Bug ID: 1799477
Summary: CVE-2020-5398 springframework: RFD attack via
Content-Disposition Header sourced from request input
by Spring MVC or Spring WebFlux Application
[fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: springframework
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: extras-orphan(a)fedoraproject.org
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dingyichen(a)gmail.com, extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1797080] New: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1797080
Bug ID: 1797080
Summary: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3
authentication bypass
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abenaiss(a)redhat.com, adam.kaplan(a)redhat.com,
aos-bugs(a)redhat.com, bmontgom(a)redhat.com,
eparis(a)redhat.com, extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com,
wzheng(a)redhat.com
Target Milestone: ---
Classification: Other
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption
key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized
attackers with knowledge of agent names to obtain the connection secrets for
those agents, which can be used to connect to Jenkins, impersonating those
agents.
References:
https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1682
http://www.openwall.com/lists/oss-security/2020/01/29/1
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1797081] New: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1797081
Bug ID: 1797081
Summary: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3
authentication bypass [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1691250] New: Upgrade snmp4j to 3.0.2
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1691250
Bug ID: 1691250
Summary: Upgrade snmp4j to 3.0.2
Product: Fedora
Version: rawhide
Status: NEW
Component: snmp4j
Keywords: Rebase
Assignee: puntogil(a)libero.it
Reporter: sbonazzo(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
Fedora currently ships 2.4.1 (2015-12-30) while upstream released 3.0.2
(2018-10-10)
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1663016] New: OpenNLP 1.9.1 available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1663016
Bug ID: 1663016
Summary: OpenNLP 1.9.1 available
Product: Fedora
Version: 29
Hardware: x86_64
OS: Linux
Status: NEW
Component: opennlp
Severity: low
Assignee: puntogil(a)libero.it
Reporter: edgar.hoch(a)ims.uni-stuttgart.de
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
Created attachment 1518001
--> https://bugzilla.redhat.com/attachment.cgi?id=1518001&action=edit
opennlp.spec for 1.9.1
Description of problem:
OpenNLP package distributed by Fedora 29 is more that four years old. Current
OpenNLP version is 1.9.1.
I have used the spec file of opennlp-1.5.3-7.fc29 and modified it until mock
creates packages for version 1.9.1. It may be that it can be more optimized.
It would be nice if someone could check it and creates updated packages for the
public.
Version-Release number of selected component (if applicable):
opennlp-1.5.3-7.fc29.noarch
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1768661] New: thredds-dap, thredds-tdcommon and thredds-tdm uninstallable
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1768661
Bug ID: 1768661
Summary: thredds-dap, thredds-tdcommon and thredds-tdm
uninstallable
Product: Fedora
Version: 31
Status: NEW
Component: thredds
Assignee: extras-orphan(a)fedoraproject.org
Reporter: phil(a)fifi.org
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
Description of problem:
None of thredds-dap, thredds-tdcommon and thredds-tdm can be installed.
Version-Release number of selected component (if applicable):
thredds-dap-4.6.2-10.fc31.noarch
thredds-tdcommon-4.6.2-10.fc31.noarch
thredds-tdm-4.6.2-10.fc31.noarch
How reproducible:
Always
Steps to Reproduce:
1. dnf install thredds-dap-4.6.2-10.fc31.noarch
thredds-tdcommon-4.6.2-10.fc31.noarch thredds-tdm-4.6.2-10.fc31.noarch
Actual results:
Error:
Problem 1: conflicting requests
- nothing provides mvn(org.springframework:spring-context) needed by
thredds-tdm-4.6.2-10.fc31.noarch
- nothing provides mvn(org.springframework:spring-core) needed by
thredds-tdm-4.6.2-10.fc31.noarch
Problem 2: conflicting requests
- nothing provides mvn(org.springframework:spring-core) needed by
thredds-tdcommon-4.6.2-10.fc31.noarch
Problem 3: conflicting requests
- nothing provides mvn(org.springframework:spring-context) needed by
thredds-dap-4.6.2-10.fc31.noarch
- nothing provides mvn(org.springframework:spring-web) needed by
thredds-dap-4.6.2-10.fc31.noarch
Expected results:
The packages should be installed.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months