[Bug 1797063] New: CVE-2020-2103 jenkins: Exposed session identifiers on user detail object in the whoAmI diagnostic page [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1797063
Bug ID: 1797063
Summary: CVE-2020-2103 jenkins: Exposed session identifiers on
user detail object in the whoAmI diagnostic page
[fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1796859] New: CVE-2019-10782 checkstyle: XML External Entity Injection due to an incomplete fix for CVE-2019-9658 [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1796859
Bug ID: 1796859
Summary: CVE-2019-10782 checkstyle: XML External Entity
Injection due to an incomplete fix for CVE-2019-9658
[fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: checkstyle
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, edewata(a)redhat.com,
extras-orphan(a)fedoraproject.org,
greg.hellings(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, nsantos(a)redhat.com,
rob.myers(a)gtri.gatech.edu
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1774726] New: CVE-2019-12422 shiro: Cookie padding oracle vulnerability with default configuration
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1774726
Bug ID: 1774726
Summary: CVE-2019-12422 shiro: Cookie padding oracle
vulnerability with default configuration
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, ataylor(a)redhat.com,
chazlett(a)redhat.com, dbecker(a)redhat.com,
drieden(a)redhat.com, extras-orphan(a)fedoraproject.org,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gvarsami(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jschluet(a)redhat.com,
kbasil(a)redhat.com, kconner(a)redhat.com,
ldimaggi(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
nwallace(a)redhat.com, puntogil(a)libero.it,
rwagner(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, slinaber(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com
Target Milestone: ---
Classification: Other
Apache Shiro before 1.4.2, when using the default "remember me" configuration,
cookies could be susceptible to a padding attack.
https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1774727] New: CVE-2019-12422 shiro: Cookie padding oracle vulnerability with default configuration [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1774727
Bug ID: 1774727
Summary: CVE-2019-12422 shiro: Cookie padding oracle
vulnerability with default configuration [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: shiro
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1829281] New: CVE-2020-1957 shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1829281
Bug ID: 1829281
Summary: CVE-2020-1957 shiro: Spring dynamic controllers, a
specially crafted request may cause an authentication
bypass
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: mrehak(a)redhat.com
CC: aileenc(a)redhat.com, ataylor(a)redhat.com,
chazlett(a)redhat.com, dbecker(a)redhat.com,
drieden(a)redhat.com, extras-orphan(a)fedoraproject.org,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jschluet(a)redhat.com,
jwon(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, ldimaggi(a)redhat.com,
lhh(a)redhat.com, lpeer(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, nwallace(a)redhat.com,
puntogil(a)libero.it, rwagner(a)redhat.com,
sclewis(a)redhat.com, scohen(a)redhat.com,
slinaber(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com
Target Milestone: ---
Classification: Other
When using Apache Shiro with Spring dynamic controllers, a specially crafted
request may cause an authentication bypass.
Upstream Advisory:
https://lists.apache.org/thread.html/r17f371fc89d34df2d0c8131473fbc681542...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1829282] New: CVE-2020-1957 shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1829282
Bug ID: 1829282
Summary: CVE-2020-1957 shiro: Spring dynamic controllers, a
specially crafted request may cause an authentication
bypass [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: shiro
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: extras-orphan(a)fedoraproject.org
Reporter: mrehak(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1815212] New: CVE-2020-1953 apache-commons-configuration: uncontrolled class instantiation when loading YAML files
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1815212
Bug ID: 1815212
Summary: CVE-2020-1953 apache-commons-configuration:
uncontrolled class instantiation when loading YAML
files
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
ataylor(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bgeorges(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, darran.lofthouse(a)redhat.com,
dblechte(a)redhat.com, decathorpe(a)gmail.com,
dfediuck(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eedri(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
fnasser(a)redhat.com, ganandan(a)redhat.com,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
gvarsami(a)redhat.com, hhorak(a)redhat.com,
hvyas(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcoleman(a)redhat.com,
jjelen(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
lthon(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puebele(a)redhat.com,
puntogil(a)libero.it, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sbonazzo(a)redhat.com,
sdaley(a)redhat.com, sherold(a)redhat.com,
smaestri(a)redhat.com, SpikeFedora(a)gmail.com,
sponnaga(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com, tom.jenkinson(a)redhat.com,
vbellur(a)redhat.com, yturgema(a)redhat.com
Target Milestone: ---
Classification: Other
Apache Commons Configuration uses a third-party library to parse YAML files
which by default allows the instantiation of classes if the YAML includes
special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5,
2.6 did not change the default settings of this library. So if a YAML file was
loaded from an untrusted source, it could therefore load and execute code out
of the control of the host application.
References:
https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b28...
https://lists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1c...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1815213] New: CVE-2020-1953 apache-commons-configuration: uncontrolled class instantiation when loading YAML files [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1815213
Bug ID: 1815213
Summary: CVE-2020-1953 apache-commons-configuration:
uncontrolled class instantiation when loading YAML
files [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: apache-commons-configuration
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: jjelen(a)redhat.com
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com, fnasser(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jjelen(a)redhat.com, SpikeFedora(a)gmail.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1799477] New: CVE-2020-5398 springframework: RFD attack via Content-Disposition Header sourced from request input by Spring MVC or Spring WebFlux Application [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1799477
Bug ID: 1799477
Summary: CVE-2020-5398 springframework: RFD attack via
Content-Disposition Header sourced from request input
by Spring MVC or Spring WebFlux Application
[fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: springframework
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: extras-orphan(a)fedoraproject.org
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dingyichen(a)gmail.com, extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months