[Bug 1796859] New: CVE-2019-10782 checkstyle: XML External Entity Injection due to an incomplete fix for CVE-2019-9658 [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1796859
Bug ID: 1796859
Summary: CVE-2019-10782 checkstyle: XML External Entity
Injection due to an incomplete fix for CVE-2019-9658
[fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: checkstyle
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, edewata(a)redhat.com,
extras-orphan(a)fedoraproject.org,
greg.hellings(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, nsantos(a)redhat.com,
rob.myers(a)gtri.gatech.edu
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months
[Bug 1774726] New: CVE-2019-12422 shiro: Cookie padding oracle vulnerability with default configuration
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1774726
Bug ID: 1774726
Summary: CVE-2019-12422 shiro: Cookie padding oracle
vulnerability with default configuration
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, ataylor(a)redhat.com,
chazlett(a)redhat.com, dbecker(a)redhat.com,
drieden(a)redhat.com, extras-orphan(a)fedoraproject.org,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gvarsami(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jschluet(a)redhat.com,
kbasil(a)redhat.com, kconner(a)redhat.com,
ldimaggi(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
nwallace(a)redhat.com, puntogil(a)libero.it,
rwagner(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, slinaber(a)redhat.com,
tcunning(a)redhat.com, tkirby(a)redhat.com
Target Milestone: ---
Classification: Other
Apache Shiro before 1.4.2, when using the default "remember me" configuration,
cookies could be susceptible to a padding attack.
https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months
[Bug 1774727] New: CVE-2019-12422 shiro: Cookie padding oracle vulnerability with default configuration [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1774727
Bug ID: 1774727
Summary: CVE-2019-12422 shiro: Cookie padding oracle
vulnerability with default configuration [fedora-all]
Product: Fedora
Version: 31
Status: NEW
Component: shiro
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: psampaio(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months
[Bug 1875232] New: CVE-2020-2230 jenkins: stored XSS vulnerability in project naming strategy
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1875232
Bug ID: 1875232
Summary: CVE-2020-2230 jenkins: stored XSS vulnerability in
project naming strategy
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: msiddiqu(a)redhat.com
CC: abenaiss(a)redhat.com, aileenc(a)redhat.com,
aos-bugs(a)redhat.com, bmontgom(a)redhat.com,
chazlett(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jwon(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Blocks: 1874833
Target Milestone: ---
Classification: Other
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project
naming strategy description that is displayed on item creation. This results in
a stored cross-site scripting (XSS) vulnerability exploitable by users with
Overall/Manage permission.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months
[Bug 1875234] New: CVE-2020-2231 jenkins: stored XSS vulnerability in 'trigger builds remotely'
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1875234
Bug ID: 1875234
Summary: CVE-2020-2231 jenkins: stored XSS vulnerability in
'trigger builds remotely'
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: msiddiqu(a)redhat.com
CC: abenaiss(a)redhat.com, aileenc(a)redhat.com,
aos-bugs(a)redhat.com, bmontgom(a)redhat.com,
chazlett(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jwon(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Blocks: 1874833
Target Milestone: ---
Classification: Other
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote
address of the host starting a build via 'Trigger builds remotely'. This
results in a stored cross-site scripting (XSS) vulnerability exploitable by
users with Job/Configure permission or knowledge of the Authentication Token.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months
[Bug 1875235] New: CVE-2020-2231 jenkins: stored XSS vulnerability in 'trigger builds remotely' [fedora-31]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1875235
Bug ID: 1875235
Summary: CVE-2020-2231 jenkins: stored XSS vulnerability in
'trigger builds remotely' [fedora-31]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: extras-orphan(a)fedoraproject.org
Reporter: msiddiqu(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-31.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months
[Bug 1875233] New: CVE-2020-2230 jenkins: stored XSS vulnerability in project naming strategy [fedora-31]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1875233
Bug ID: 1875233
Summary: CVE-2020-2230 jenkins: stored XSS vulnerability in
project naming strategy [fedora-31]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: extras-orphan(a)fedoraproject.org
Reporter: msiddiqu(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-31.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months
[Bug 1874830] New: CVE-2020-2229 jenkins: user-specified tooltip values leads to stored cross-site scripting
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1874830
Bug ID: 1874830
Summary: CVE-2020-2229 jenkins: user-specified tooltip values
leads to stored cross-site scripting
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: msiddiqu(a)redhat.com
CC: abenaiss(a)redhat.com, aileenc(a)redhat.com,
aos-bugs(a)redhat.com, bmontgom(a)redhat.com,
chazlett(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jwon(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip
content of help icons. Tooltip values can be contributed by plugins, some of
which use user-specified values. This results in a stored cross-site scripting
(XSS) vulnerability.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months
[Bug 1874831] New: CVE-2020-2229 jenkins: user-specified tooltip values leads to stored cross-site scripting [fedora-31]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1874831
Bug ID: 1874831
Summary: CVE-2020-2229 jenkins: user-specified tooltip values
leads to stored cross-site scripting [fedora-31]
Product: Fedora
Version: 31
Status: NEW
Component: jenkins
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: extras-orphan(a)fedoraproject.org
Reporter: msiddiqu(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-31.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months