[Bug 1787312] New: Please, update to 3.2.6
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1787312
Bug ID: 1787312
Summary: Please, update to 3.2.6
Product: Fedora
Version: rawhide
Status: NEW
Component: mockito
Assignee: rkennke(a)redhat.com
Reporter: jjelen(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, mat.booth(a)redhat.com,
omajid(a)redhat.com, projects.rg(a)smart.ms,
rkennke(a)redhat.com, roman(a)fenkhuber.at
Target Milestone: ---
Classification: Fedora
The latest upstream version of mockito is 3.26, while fedora still sticks with
2.x, which is blocking updating some of the new packages to use the new
features.
https://site.mockito.org/
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months
[Bug 1821315] New: CVE-2020-11113 jackson-databind: jackson-databind: mishandles the interaction between serialization gadgets and typing related to org.apache.openjpa.ee.WASRegistryManagedRuntime which could result in remote command execution
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1821315
Bug ID: 1821315
Summary: CVE-2020-11113 jackson-databind: jackson-databind:
mishandles the interaction between serialization
gadgets and typing related to
org.apache.openjpa.ee.WASRegistryManagedRuntime which
could result in remote command execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mkaplan(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
decathorpe(a)gmail.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, hhudgeon(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jjoyce(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jschatte(a)redhat.com, jschluet(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kbasil(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lef(a)fedoraproject.org, lgao(a)redhat.com,
lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com,
lzap(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, mmccune(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
nmoumoul(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rchan(a)redhat.com, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rjerrido(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
sokeeffe(a)redhat.com, sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com,
vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jackson-databind 2.x before 2.9.10.4 mishandles
the interaction between serialization gadgets and typing, related to
org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1821304] New: CVE-2020-11111 jackson-databind: jackson-databind: mishandles the interaction between serialization gadgets and typing related to org.apache.activemq.* which could result in remote command execution
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1821304
Bug ID: 1821304
Summary: CVE-2020-11111 jackson-databind: jackson-databind:
mishandles the interaction between serialization
gadgets and typing related to org.apache.activemq.*
which could result in remote command execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mkaplan(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bgeorges(a)redhat.com, bmaxwell(a)redhat.com,
bmontgom(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
decathorpe(a)gmail.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, ibek(a)redhat.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jjoyce(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jschatte(a)redhat.com, jschluet(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kbasil(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lef(a)fedoraproject.org, lgao(a)redhat.com,
lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pdrozd(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
sclewis(a)redhat.com, scohen(a)redhat.com,
sdaley(a)redhat.com, slinaber(a)redhat.com,
smaestri(a)redhat.com, sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jackson-databind 2.x before 2.9.10.4 mishandles
the interaction between serialization gadgets and typing, related to
org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and
activemq-pool-jms).
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1821311] New: CVE-2020-11112 jackson-databind: jackson-databind: mishandles the interaction between serialization gadgets and typing related to org.apache.commons.proxy.provider.remoting.RmiProvider which could result in remote command execution
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1821311
Bug ID: 1821311
Summary: CVE-2020-11112 jackson-databind: jackson-databind:
mishandles the interaction between serialization
gadgets and typing related to
org.apache.commons.proxy.provider.remoting.RmiProvider
which could result in remote command execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mkaplan(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
decathorpe(a)gmail.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, hhudgeon(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jjoyce(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jschatte(a)redhat.com, jschluet(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kbasil(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lef(a)fedoraproject.org, lgao(a)redhat.com,
lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com,
lzap(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, mmccune(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
nmoumoul(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rchan(a)redhat.com, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rjerrido(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
sokeeffe(a)redhat.com, sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com,
vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jackson-databind 2.x before 2.9.10.4 mishandles
the interaction between serialization gadgets and typing, related to
org.apache.commons.proxy.provider.remoting.RmiProvider (aka
apache/commons-proxy).
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1819208] New: CVE-2020-10968 jackson-databind: serialization gadgets in bus-proxy
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819208
Bug ID: 1819208
Summary: CVE-2020-10968 jackson-databind: serialization gadgets
in bus-proxy
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cbyrne(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, cmacedo(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
decathorpe(a)gmail.com, dffrench(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, drusso(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, hhorak(a)redhat.com,
hhudgeon(a)redhat.com, ibek(a)redhat.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jjoyce(a)redhat.com, jmadigan(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschluet(a)redhat.com,
jshepherd(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lthon(a)redhat.com, lzap(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, mmccune(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
ngough(a)redhat.com, nmoumoul(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pdrozd(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, pwright(a)redhat.com,
rchan(a)redhat.com, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rjerrido(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
sokeeffe(a)redhat.com, sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com,
trepel(a)redhat.com
Target Milestone: ---
Classification: Other
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction
between serialization gadgets and typing, related to
org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
Reference:
https://github.com/FasterXML/jackson-databind/issues/2662
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1702439] New: CVE-2019-0223 qpid-proton: TLS Man in the Middle Vulnerability
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1702439
Bug ID: 1702439
Summary: CVE-2019-0223 qpid-proton: TLS Man in the Middle
Vulnerability
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=important,public=20190423,reported=20190423,sou
rce=oss-security,cvss3=7.4/CVSS:3.0/AV:N/AC:H/PR:N/UI:
N/S:U/C:H/I:H/A:N,cwe=CWE-295->CWE-300,fedora-all/qpid
-proton-java=notaffected,amq-6/proton-j=new,fuse-6/pro
ton-j=new,fuse-7/proton-j=new,vertx-3/proton-j=new,amq
-7/qpid-proton=new,fedora-all/qpid-proton=notaffected,
rhn_satellite_6/qpid-proton=new,cfme-5/qpid-proton=new
,openstack-7/qpid-proton=new,openstack-8/qpid-proton=n
ew,openstack-14/qpid-proton=new,openstack-14-optools/q
pid-proton=new,openstack-rdo/qpid-proton=affected,mrg-
m-3/qpid-proton=new,rhui-3/qpid-proton=new,rhev-m-4/qp
id-proton=new,amq-7/proton-j=new,mrg-m-3/qpid-proton-j
ava=new
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: aileenc(a)redhat.com, apevec(a)redhat.com,
ataylor(a)redhat.com, avibelli(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmcclain(a)redhat.com, btotty(a)redhat.com,
chazlett(a)redhat.com, dajohnso(a)redhat.com,
dbecker(a)redhat.com, dblechte(a)redhat.com,
dfediuck(a)redhat.com, dmetzger(a)redhat.com,
eedri(a)redhat.com, esammons(a)redhat.com,
gblomqui(a)redhat.com, gmccullo(a)redhat.com,
gtanzill(a)redhat.com, hhudgeon(a)redhat.com,
iboverma(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jbalunas(a)redhat.com, jfrey(a)redhat.com,
jhardy(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jpallich(a)redhat.com,
jprause(a)redhat.com, jross(a)redhat.com,
jschluet(a)redhat.com, jshepherd(a)redhat.com,
kbasil(a)redhat.com, kdixon(a)redhat.com,
kgiusti(a)gmail.com, krathod(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lthon(a)redhat.com, mburns(a)redhat.com,
mcressma(a)redhat.com, messaging-bugs(a)redhat.com,
mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com,
mmccune(a)redhat.com, mszynkie(a)redhat.com,
obarenbo(a)redhat.com, pgallagh(a)redhat.com,
puntogil(a)libero.it, rchan(a)redhat.com,
rhos-maint(a)redhat.com, rjerrido(a)redhat.com,
roliveri(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, sbonazzo(a)redhat.com,
sclewis(a)redhat.com, sherold(a)redhat.com,
simaishi(a)redhat.com, slinaber(a)redhat.com,
tjay(a)redhat.com, trogers(a)redhat.com
Target Milestone: ---
Classification: Other
The TLS support in Apache Qpid Proton 0.9 - 0.27.0 when using OpenSSL prior to
1.1.0 can under some circumstances connect as a client to a TLS server that
offers anonymous ciphers irrespective of whether the client was configured to
verify the server's certificate or certificate against the hostname used to
connect. This means that an undetected man in the middle attack could be
constructed if an attacker can arrange to intercept TLS traffic. This
includes the Qpid Proton C library, and all language binding libraries using
it. This attack will not work if client certificate authentication is
in use as anonymous ciphers cannot be used in this case.
References:
https://issues.apache.org/jira/browse/PROTON-2014
https://qpid.apache.org/cves/CVE-2019-0223.html
Upstream Patch:
https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=97c7733
https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=159fac1
https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=4aea0fd
https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=2d3ba8a
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1822759] New: CVE-2020-1950 tika: excessive memory usage in PSDParser
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1822759
Bug ID: 1822759
Summary: CVE-2020-1950 tika: excessive memory usage in
PSDParser
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, bkearney(a)redhat.com,
chazlett(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
gvarsami(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jolee(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lef(a)fedoraproject.org, mnovotny(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pjindal(a)redhat.com, puntogil(a)libero.it,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
A carefully crafted or corrupt PSD file can cause excessive memory usage in
Apache Tika's PSDParser in versions 1.0-1.23.
Reference:
https://lists.apache.org/thread.html/r463b1a67817ae55fe022536edd6db34e8f9...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1703402] New: CVE-2019-2692 mysql-connector-java: privilege escalation in MySQL connector
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1703402
Bug ID: 1703402
Summary: CVE-2019-2692 mysql-connector-java: privilege
escalation in MySQL connector
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190423,reported=20190424,sour
ce=cve,cvss3=6.3/CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/
I:H/A:H,cwe=CWE-843,fedora-all/mysql-connector-java=no
taffected,openshift-enterprise-3/mysql-connector-java=
new,fsw-6/mysql-connector-java=new,fuse-7/mysql-connec
tor-java=new,rhel-6/mysql-connector-java=new,rhel-7/my
sql-connector-java=new,rhn_satellite_6/mysql-connector
-java=new
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: ahardin(a)redhat.com, aileenc(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bkearney(a)redhat.com, bleanhar(a)redhat.com,
btotty(a)redhat.com, ccoleman(a)redhat.com,
chazlett(a)redhat.com, databases-maint(a)redhat.com,
dedgar(a)redhat.com, eparis(a)redhat.com,
gvarsami(a)redhat.com, hhorak(a)redhat.com,
hhudgeon(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jgoulding(a)redhat.com,
jjanco(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, kconner(a)redhat.com,
ldimaggi(a)redhat.com, mchappel(a)redhat.com,
mmccune(a)redhat.com, mmuzila(a)redhat.com,
mschorm(a)redhat.com, nwallace(a)redhat.com,
puntogil(a)libero.it, rchan(a)redhat.com,
rjerrido(a)redhat.com, rwagner(a)redhat.com,
steve.traylen(a)cern.ch, tcunning(a)redhat.com,
tkirby(a)redhat.com, xjakub(a)fi.muni.cz
Target Milestone: ---
Classification: Other
Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent:
Connector/J). Supported versions that are affected are 8.0.15 and prior.
Difficult to exploit vulnerability allows high privileged attacker with logon
to the infrastructure where MySQL Connectors executes to compromise MySQL
Connectors. Successful attacks require human interaction from a person other
than the attacker. Successful attacks of this vulnerability can result in
takeover of MySQL Connectors.
Reference:
http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1801380] New: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1801380
Bug ID: 1801380
Summary: CVE-2020-7226 cryptacular: excessive memory allocation
during a decode operation
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, darran.lofthouse(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, etirelli(a)redhat.com,
extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jochrist(a)redhat.com,
jperkins(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lef(a)fedoraproject.org, lgao(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pdrozd(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
sdaley(a)redhat.com, smaestri(a)redhat.com,
sthorger(a)redhat.com, tom.jenkinson(a)redhat.com
Target Milestone: ---
Classification: Other
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other
products, allows attackers to trigger excessive memory allocation during a
decode operation, because the nonce array length associated with "new byte" may
depend on untrusted input within the header of encoded data.
Reference:
https://github.com/vt-middleware/cryptacular/issues/52
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months
[Bug 1845547] New: CVE-2020-1695 resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1845547
Bug ID: 1845547
Summary: CVE-2020-1695 resteasy: Improper validation of
response header in MediaTypeHeaderDelegate.java class
[fedora-all]
Product: Fedora
Version: 32
Status: NEW
Component: resteasy
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: dmoluguw(a)redhat.com
Reporter: cbuissar(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, ascheel(a)redhat.com,
dingyichen(a)gmail.com, dmoluguw(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it,
stewardship-sig(a)lists.fedoraproject.org,
weli(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 5 months