[Bug 1852863] New: CVE-2020-8022 tomcat: /usr/lib/tmpfiles.d/tomcat.conf is group-writable
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1852863
Bug ID: 1852863
Summary: CVE-2020-8022 tomcat: /usr/lib/tmpfiles.d/tomcat.conf
is group-writable
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bgeorges(a)redhat.com,
bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmoulliard(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, huwang(a)redhat.com, ibek(a)redhat.com,
ikanello(a)redhat.com, ivan.afonichev(a)gmail.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jolee(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lthon(a)redhat.com, mbabacek(a)redhat.com,
mburns(a)redhat.com, mizdebsk(a)redhat.com,
mkolesni(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
rguimara(a)redhat.com, rhcs-maint(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com,
weli(a)redhat.com
Target Milestone: ---
Classification: Other
A Incorrect Default Permissions vulnerability in the packaging of tomcat on
SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux
Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE
Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE
Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE
Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP
12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE
OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to
escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage
5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server
12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise
Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux
Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE
Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1.
SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1.
SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1.
SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3.
SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to
8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions
prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat
versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior
to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to
8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to
8.0.53-29.32.1.
Reference:
https://bugzilla.suse.com/show_bug.cgi?id=1172405
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 8 months
[Bug 1819713] New: CVE-2019-10399 jenkins-script-security-plugin: handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819713
Bug ID: 1819713
Summary: CVE-2019-10399 jenkins-script-security-plugin:
handling of property names in property expressions in
increment and decrement expressions allowed attackers
to execute arbitrary code in sandboxed scripts
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and
earlier related to the handling of property names in property expressions in
increment and decrement expressions allowed attackers to execute arbitrary code
in sandboxed scripts.
Reference:
http://www.openwall.com/lists/oss-security/2019/09/12/2
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 8 months
[Bug 1819708] New: CVE-2019-10400 jenkins-script-security-plugin: handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819708
Bug ID: 1819708
Summary: CVE-2019-10400 jenkins-script-security-plugin:
handling of subexpressions in increment and decrement
expressions not involving actual assignment allowed
attackers to execute arbitrary code in sandboxed
scripts
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and
earlier related to the handling of subexpressions in increment and decrement
expressions not involving actual assignment allowed attackers to execute
arbitrary code in sandboxed scripts.
Reference:
http://www.openwall.com/lists/oss-security/2019/09/12/2
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 8 months
[Bug 1819697] New: CVE-2019-10393 jenkins-script-security-plugin: handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819697
Bug ID: 1819697
Summary: CVE-2019-10393 jenkins-script-security-plugin:
handling of method names in method call expressions
allowed attackers to execute arbitrary code in
sandboxed scripts
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and
earlier related to the handling of method names in method call expressions
allowed attackers to execute arbitrary code in sandboxed scripts.
Reference:
http://www.openwall.com/lists/oss-security/2019/09/12/2
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 8 months
[Bug 1819692] New: CVE-2019-10394 jenkins-script-security-plugin: handling of property names in property expressions on the left-hand side of assignment expression leads to execute arbitrary code in sandboxed scripts
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819692
Bug ID: 1819692
Summary: CVE-2019-10394 jenkins-script-security-plugin:
handling of property names in property expressions on
the left-hand side of assignment expression leads to
execute arbitrary code in sandboxed scripts
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and
earlier related to the handling of property names in property expressions on
the left-hand side of assignment expressions allowed attackers to execute
arbitrary code in sandboxed scripts.
Reference:
http://www.openwall.com/lists/oss-security/2019/09/12/2
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 8 months