[Bug 1941544] New: CVE-2021-20289 resteasy: Error message exposes endpoint class information [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1941544
Bug ID: 1941544
Summary: CVE-2021-20289 resteasy: Error message exposes
endpoint class information [fedora-all]
Product: Fedora
Version: 33
Status: NEW
Component: resteasy
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: edewata(a)redhat.com
Reporter: rschiron(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, alexander.m.scheel(a)gmail.com,
cfu(a)redhat.com, dchen(a)redhat.com, edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mkdineshprasanth(a)gmail.com,
puntogil(a)libero.it, weli(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 11 months
[Bug 1941056] New: CVE-2021-27807 pdfbox: infinite loop while loading crafted PDF file [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1941056
Bug ID: 1941056
Summary: CVE-2021-27807 pdfbox: infinite loop while loading
crafted PDF file [fedora-all]
Product: Fedora
Version: 33
Status: NEW
Component: pdfbox
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: sergio(a)serjux.com
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it, sergio(a)serjux.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 11 months
[Bug 1941051] New: CVE-2021-27906 pdfbox: OutOfMemory-Exception while loading a crafted PDF file [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1941051
Bug ID: 1941051
Summary: CVE-2021-27906 pdfbox: OutOfMemory-Exception while
loading a crafted PDF file [fedora-all]
Product: Fedora
Version: 33
Status: NEW
Component: pdfbox
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: sergio(a)serjux.com
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it, sergio(a)serjux.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 11 months
[Bug 1903702] New: CVE-2020-11979 ant: insecure temporary file
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1903702
Bug ID: 1903702
Summary: CVE-2020-11979 ant: insecure temporary file
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aboyko(a)redhat.com,
aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, aos-bugs(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
bmontgom(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, eleandro(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, gvarsami(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
jaromir.capik(a)email.cz, java-maint(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jburrell(a)redhat.com,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, mizdebsk(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msrb(a)redhat.com, msvehla(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
pbhattac(a)redhat.com, pcheung(a)redhat.com,
pdrozd(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
smaestri(a)redhat.com, spinder(a)redhat.com,
sponnaga(a)redhat.com, sthorger(a)redhat.com,
swoodman(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
tom.jenkinson(a)redhat.com, vbobade(a)redhat.com,
vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of
temporary files it created so that only the current user was allowed to access
them. Unfortunately the fixcrlf task deleted the temporary file and created a
new one without said protection, effectively nullifying the effort. This would
still allow an attacker to inject modified source files into the build process.
References:
https://lists.apache.org/thread.html/r107ea1b1a7a214bc72fe1a04207546ccef5...
https://lists.apache.org/thread.html/r1dc8518dc99c42ecca5ff82d0d2de64cd5d...
https://lists.apache.org/thread.html/r2306b67f20c24942b872b0a41fbdc9330e8...
https://lists.apache.org/thread.html/r4ca33fad3fb39d130cda287d5a60727d9e7...
https://lists.apache.org/thread.html/r5e1cdd79f019162f76414708b2092acad0a...
https://lists.apache.org/thread.html/rc3c8ef9724b5b1e171529b47f4b35cb7920...
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedo...
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedo...
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedo...
https://security.gentoo.org/glsa/202011-18
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 11 months
[Bug 1903705] New: CVE-2020-11979 ant:1.10/ant: insecure temporary file [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1903705
Bug ID: 1903705
Summary: CVE-2020-11979 ant:1.10/ant: insecure temporary file
[fedora-all]
Product: Fedora
Version: 33
Status: NEW
Component: ant
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: darunesh(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com, jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 11 months
[Bug 1699483] New: maven-3.6.1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1699483
Bug ID: 1699483
Summary: maven-3.6.1 is available
Product: Fedora Modules
Status: NEW
Component: maven
Keywords: FutureFeature, Triaged
Assignee: mizdebsk(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, extras-qa(a)fedoraproject.org,
jamielinux(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mhroncok(a)redhat.com, mizdebsk(a)redhat.com,
mkoncek(a)redhat.com, msrb(a)redhat.com,
sochotni(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
upstream-release-monitoring(a)fedoraproject.org
Target Milestone: ---
Classification: Fedora
+++ This bug was initially created as a clone of Bug #1699465 +++
Latest upstream release: 3.6.1
Current version/release in rawhide: 3.5.4-7.fc30
URL: https://maven.apache.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1894/
--- Additional comment from Mikolaj Izdebski on 2019-04-12 23:02:26 CEST ---
Maven 3.6.1 requires XMLUnit >= 2,
https://src.fedoraproject.org/rpms/xmlunit/pull-request/1
Marian Koncek has a patch for this update.
I will be creating a new module stream with Maven 3.6.x
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 11 months
[Bug 1925638] New: Ant fails to use the java jvm configured by the alternatives command
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1925638
Bug ID: 1925638
Summary: Ant fails to use the java jvm configured by the
alternatives command
Product: Fedora
Version: 33
Hardware: All
OS: Linux
Status: NEW
Component: ant
Severity: medium
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: bill_chatfield(a)yahoo.com
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com, jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
Ant does not use the version of java configured by the alternatives command. It
uses bash functions that are part of javapackages-tools to determine which java
command to run instead of just using the java I told it to use with the
alternatives commands. Furthermore, there should only be one method of
determining which java to run. The alternatives system and the functions in
javapackages-tools are redundant. One of them needs to be removed.
Version-Release number of selected component (if applicable):
ant-1.10.9-1.fc33
How reproducible:
Configure java 1.8 with the alternatives command and then run an ant build.
Steps to Reproduce:
1. sudo dnf -y install java-11-openjdk-devel java-1.8.0-openjdk-devel
javapackages-tools
2. sudo alternatives --set java java-1.8.0-openjdk.x86_64
3. echo '<project> <echo message="java.home=${java.home}"/> </project>' | cat >
build.xml
4. ant
Actual results: (ant using java 11 after 1.8 was configured)
Buildfile: /home/bill/build.xml
[echo] java.home=/usr/lib/jvm/java-11-openjdk-11.0.9.11-9.fc33.x86_64
BUILD SUCCESSFUL
Total time: 0 seconds
Expected results: (ant should be using 1.8)
Buildfile: /home/bill/build.xml
[echo] java.home=/usr/lib/jvm/java-1.8-openjdk...
BUILD SUCCESSFUL
Total time: 0 seconds
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years
[Bug 1937445] New: CVE-2020-13959 velocity: XSS in the default error page for VelocityView
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1937445
Bug ID: 1937445
Summary: CVE-2020-13959 velocity: XSS in the default error page
for VelocityView
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, akurtako(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
andjrobins(a)gmail.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
bbaranow(a)redhat.com, bibryam(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, darran.lofthouse(a)redhat.com,
dbhole(a)redhat.com, decathorpe(a)gmail.com,
devrim(a)gunduz.org, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
ebaron(a)redhat.com,
eclipse-sig(a)lists.fedoraproject.org,
eleandro(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, fjuma(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
hbraun(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com, java-maint(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jcoleman(a)redhat.com, jerboaa(a)gmail.com,
jjohnstn(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jperkins(a)redhat.com, jross(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, ldimaggi(a)redhat.com,
lef(a)fedoraproject.org, lgao(a)redhat.com,
loleary(a)redhat.com, mat.booth(a)redhat.com,
mizdebsk(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
pantinor(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, rgrunber(a)redhat.com,
rguimara(a)redhat.com, rhcs-maint(a)redhat.com,
rrajasek(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
sd-operator-metering(a)redhat.com, smaestri(a)redhat.com,
sochotni(a)redhat.com, spinder(a)redhat.com,
sponnaga(a)redhat.com, tcunning(a)redhat.com,
tflannag(a)redhat.com, theute(a)redhat.com,
tkirby(a)redhat.com, tom.jenkinson(a)redhat.com,
yborgess(a)redhat.com
Target Milestone: ---
Classification: Other
The default error page for VelocityView in Apache Velocity Tools prior to 3.1
reflects back the vm file that was entered as part of the URL. An attacker can
set an XSS payload file as this vm file in the URL which results in this
payload being executed. XSS vulnerabilities allow attackers to execute
arbitrary JavaScript in the context of the attacked website and the attacked
user. This can be abused to steal session cookies, perform requests in the name
of the victim or for phishing attacks.
References:
https://lists.apache.org/thread.html/r6802a38c3041059e763a1aadd7b37fe95de...
http://www.openwall.com/lists/oss-security/2021/03/10/2
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years
[Bug 1937447] New: CVE-2020-13959 velocity: XSS in the default error page for VelocityView [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1937447
Bug ID: 1937447
Summary: CVE-2020-13959 velocity: XSS in the default error page
for VelocityView [fedora-all]
Product: Fedora
Version: 33
Status: NEW
Component: velocity
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, decathorpe(a)gmail.com,
devrim(a)gunduz.org,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, sochotni(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years