[Bug 1902827] New: CVE-2020-27218 jetty: buffer not correctly recycled in Gzip Request inflation [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1902827
Bug ID: 1902827
Summary: CVE-2020-27218 jetty: buffer not correctly recycled in
Gzip Request inflation [fedora-all]
Product: Fedora
Version: 33
Status: NEW
Component: jetty
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: mat.booth(a)redhat.com
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jjohnstn(a)redhat.com, krzysztof.daniel(a)gmail.com,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
sochotni(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 11 months
[Bug 1837444] New: CVE-2020-1945 ant: insecure temporary file vulnerability
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1837444
Bug ID: 1837444
Summary: CVE-2020-1945 ant: insecure temporary file
vulnerability
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
bmontgom(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com,
dkreling(a)redhat.com, dmoluguw(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, gvarsami(a)redhat.com,
hvyas(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
jaromir.capik(a)email.cz, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jburrell(a)redhat.com,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, mizdebsk(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msrb(a)redhat.com, msvehla(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pcheung(a)redhat.com,
pdrozd(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puebele(a)redhat.com, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
smaestri(a)redhat.com, spinder(a)redhat.com,
sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tcunning(a)redhat.com, theute(a)redhat.com,
tkirby(a)redhat.com, tom.jenkinson(a)redhat.com,
vbellur(a)redhat.com, vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary
directory identified by the Java system property java.io.tmpdir for several
tasks and may thus leak sensitive information. The fixcrlf and replaceregexp
tasks also copy files from the temporary directory back into the build tree
allowing an attacker to inject modified source files into the build process.
References:
https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plu...
https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years
[Bug 1847093] New: antrl3 mock build requires antrl3-tools, which is built by... antlr3.
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1847093
Bug ID: 1847093
Summary: antrl3 mock build requires antrl3-tools, which is
built by... antlr3.
Product: Fedora
Version: 32
Status: NEW
Component: antlr3
Severity: high
Assignee: loganjerry(a)gmail.com
Reporter: gilboad(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dingyichen(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
loganjerry(a)gmail.com, mizdebsk(a)redhat.com,
walters(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
I'm trying to build antrl3 under CentOS 8.
While trying to slowly build the dependency chain I noticed a BuildRequires:
mvn(org.antlr:antlr3-maven-plugin) which is met by installing (under Fedora 32)
antlr3-tools.
Checking the source of antrl3-tools, I noticed its being built by
antlr3.src.rpm.
BTW, the same issue can be found in stringtemplate4, which is required by
antlr3 build, but itself requires antrl3-tools.
Version-Release number of selected component (if applicable):
antlr3-3.5.2-25.fc32.src.rpm
How reproducible:
Always.
Packages:
A. antlr3:
$ mock -r fedora-32-x86_64 antlr3-3.5.2-27.fc32.src.rpm
...
Installing:
ant noarch 1.10.8-1.fc32
updates 164 k
<--------------------------------------------------------->
antlr3-tool noarch 1:3.5.2-27.fc32
updates 1.1 M
<--------------------------------------------------------->
autoconf noarch 2.69-33.fc32
fedora 666 k
automake noarch 1.16.1-14.fc32
fedora 665 k
doxygen x86_64 1:1.8.17-2.fc32
fedora 4.8 M
graphviz x86_64 2.42.4-1.fc32
fedora 3.4 M
libtool x86_64 2.4.6-33.fc32
fedora 579 k
maven-lib noarch 1:3.6.1-5.fc32
fedora 1.4 M
maven-local noarch 5.3.0-9.fc32
fedora 8.7 k
maven-plugin-bundle noarch 3.5.1-4.fc32
fedora 201 k
maven-plugin-plugin noarch 3.5.1-7.fc32
fedora 61 k
maven-project noarch 2.2.1-63.fc32
fedora 155 k
plexus-compiler noarch 2.8.5-2.fc32
fedora 65 k
sonatype-oss-parent noarch 7-19.fc32
fedora 13 k
stringtemplate noarch 3.2.1-21.fc32
fedora 134 k
<--------------------------------------------------------->
stringtemplate4 noarch 4.3-2.fc32
fedora 247 k
<--------------------------------------------------------->
...
Wrote: /builddir/build/RPMS/antlr3-java-3.5.2-27.fc32.noarch.rpm
Wrote: /builddir/build/RPMS/antlr3-C-3.4-3.5.2.27.fc32.x86_64.rpm
Wrote: /builddir/build/RPMS/antlr3-javascript-3.1-3.5.2.27.fc32.noarch.rpm
Wrote: /builddir/build/RPMS/antlr3-C-debuginfo-3.4-3.5.2.27.fc32.x86_64.rpm
Wrote: /builddir/build/RPMS/antlr3-C++-devel-3.5.2-27.fc32.x86_64.rpm
<--------------------------------------------------------->
Wrote: /builddir/build/RPMS/antlr3-tool-3.5.2-27.fc32.noarch.rpm
<--------------------------------------------------------->
Wrote: /builddir/build/RPMS/antlr3-C-devel-3.4-3.5.2.27.fc32.x86_64.rpm
Wrote: /builddir/build/RPMS/antlr3-debugsource-3.5.2-27.fc32.x86_64.rpm
B. stringtemplate4:
$ mock -r fedora-32-x86_64 stringtemplate4-4.3-2.fc32.src.rpm
...
Installing:
antlr3-java noarch 1:3.5.2-27.fc32
updates 160 k
<--------------------------------------------------------->
antlr3-tool noarch 1:3.5.2-27.fc32
updates 1.1 M
<--------------------------------------------------------->
junit noarch 1:4.12-13.fc32
fedora 283 k
maven-local noarch 5.3.0-9.fc32
fedora 8.7 k
sonatype-oss-parent noarch 7-19.fc32
fedora 13 k
xorg-x11-fonts-Type1 noarch 7.5-24.fc32
fedora 500 k
xorg-x11-server-Xvfb x86_64 1.20.8-1.fc32
fedora 879 k
...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years