[Bug 1693325] New: CVE-2019-0199 tomcat: Apache Tomcat HTTP/2 DoS
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1693325
Bug ID: 1693325
Summary: CVE-2019-0199 tomcat: Apache Tomcat HTTP/2 DoS
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=important,public=20190325,reported=20190326,sou
rce=internet,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:
U/C:N/I:N/A:H,cwe=CWE-400,fedora-all/tomcat=affected,r
hscl-3/rh-java-common-tomcat=notaffected,bpms-6/tomcat
=notaffected,brms-6/tomcat=notaffected,epel-all/tomcat
=notaffected,brms-5/jbossweb=notaffected,eap-6/jbosswe
b=notaffected,eap-5/jbossweb=notaffected,jdg-6/jbosswe
b=notaffected,jdg-7/tomcat=notaffected,jdv-6/jbossweb=
notaffected,fuse-6/tomcat=notaffected,fuse-7/tomcat=no
taffected,fsw-6/jbossweb=notaffected,soap-5/jbossweb=n
otaffected,springboot-1/tomcat=notaffected,jbews-2/tom
cat6=notaffected,jws-3/tomcat7=notaffected,rhel-7/tomc
at=notaffected,jbews-2/tomcat7=notaffected,jws-3/tomca
t8=new,rhel-6/tomcat6=notaffected,jon-3/jbossweb=notaf
fected,jws-5/tomcat=new
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, anstephe(a)redhat.com,
apintea(a)redhat.com, avibelli(a)redhat.com,
bgeorges(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmoulliard(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dimitris(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, etirelli(a)redhat.com,
fgavrilo(a)redhat.com, gvarsami(a)redhat.com,
gzaronik(a)redhat.com, hhorak(a)redhat.com,
ibek(a)redhat.com, ikanello(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdoyle(a)redhat.com, jolee(a)redhat.com,
jondruse(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jschatte(a)redhat.com,
jshepherd(a)redhat.com, jstastny(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
loleary(a)redhat.com, lpetrovi(a)redhat.com,
lthon(a)redhat.com, mbabacek(a)redhat.com,
mizdebsk(a)redhat.com, mszynkie(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pgallagh(a)redhat.com,
pgier(a)redhat.com, pjurak(a)redhat.com,
ppalaga(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, pszubiak(a)redhat.com,
rnetuka(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
sdaley(a)redhat.com, spinder(a)redhat.com,
tcunning(a)redhat.com, theute(a)redhat.com,
tkirby(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Apache Tomcat version from 9.0.0.M1 to 9.0.14
inclusive and 8.5.0 to 8.5.37 inclusive. The HTTP/2 implementation accepted
streams with excessive numbers of SETTINGS frames and also permitted clients to
keep streams open without reading/writing request/response data. By keeping
streams open for requests that utilised the Servlet API's blocking I/O, clients
were able to cause server-side threads to block eventually leading to thread
exhaustion and a DoS.
References:
https://mail-archives.apache.org/mod_mbox/tomcat-announce/201903.mbox/bro...
http://tomcat.apache.org/security-9.html
http://tomcat.apache.org/security-8.html
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 7 months
[Bug 1918544] New: fop-2.6 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1918544
Bug ID: 1918544
Summary: fop-2.6 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: fop
Keywords: FutureFeature, Triaged
Assignee: lemenkov(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
lemenkov(a)gmail.com, mizdebsk(a)redhat.com,
rhbugs(a)n-dimensional.de, rlandman(a)redhat.com,
tim(a)tim-landscheidt.de
Target Milestone: ---
Classification: Fedora
Latest upstream release: 2.6
Current version/release in rawhide: 2.5-1.fc34
URL: https://xmlgraphics.apache.org/fop/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/829/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 7 months
[Bug 1972764] New: lucene-8.9.0 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1972764
Bug ID: 1972764
Summary: lucene-8.9.0 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: lucene
Keywords: FutureFeature, Triaged
Assignee: akurtako(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, dbhole(a)redhat.com,
dchen(a)redhat.com, eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com,
lef(a)fedoraproject.org, rgrunber(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 8.9.0
Current version/release in rawhide: 8.8.2-1.fc35
URL: http://lucene.apache.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/7178/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 7 months
[Bug 1971648] New: CVE-2021-31811 pdfbox: OutOfMemory-Exception while loading a crafted PDF file
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1971648
Bug ID: 1971648
Summary: CVE-2021-31811 pdfbox: OutOfMemory-Exception while
loading a crafted PDF file
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, bibryam(a)redhat.com,
chazlett(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
hbraun(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jolee(a)redhat.com, jrokos(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, mnovotny(a)redhat.com,
nwallace(a)redhat.com, pantinor(a)redhat.com,
pjindal(a)redhat.com, puntogil(a)libero.it,
rhel8-maint(a)redhat.com, rrajasek(a)redhat.com,
rwagner(a)redhat.com, sergio(a)serjux.com,
tcunning(a)redhat.com, tkirby(a)redhat.com,
tzimanyi(a)redhat.com
Target Milestone: ---
Classification: Other
In Apache PDFBox, a carefully crafted PDF file can trigger an
OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox
version 2.0.23 and prior 2.0.x versions.
References:
https://www.openwall.com/lists/oss-security/2021/06/12/2
https://lists.apache.org/thread.html/re3bd16f0cc8f1fbda46b06a4b8241cd417f...
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 8 months
[Bug 1880101] New: CVE-2020-13920 activemq: improper authentication allows MITM attack
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1880101
Bug ID: 1880101
Summary: CVE-2020-13920 activemq: improper authentication
allows MITM attack
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
ataylor(a)redhat.com, bbaranow(a)redhat.com,
bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, dblechte(a)redhat.com,
dfediuck(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eedri(a)redhat.com, eleandro(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jochrist(a)redhat.com, jperkins(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
nwallace(a)redhat.com, pdrozd(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
sbonazzo(a)redhat.com, sdaley(a)redhat.com,
sherold(a)redhat.com, smaestri(a)redhat.com,
sthorger(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com, tom.jenkinson(a)redhat.com,
yturgema(a)redhat.com
Target Milestone: ---
Classification: Other
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI
registry and binds the server to the "jmxrmi" entry. It is possible to connect
to the registry without authentication and call the rebind method to rebind
jmxrmi to something else. If an attacker creates another server to proxy the
original, and bound that, he effectively becomes a man in the middle and is
able to intercept the credentials when an user connects. Upgrade to Apache
ActiveMQ 5.15.12.
Reference:
http://activemq.apache.org/security-advisories.data/CVE-2020-13920-announ...
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 8 months
[Bug 1941055] New: CVE-2021-27807 pdfbox: infinite loop while loading crafted PDF file
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1941055
Bug ID: 1941055
Summary: CVE-2021-27807 pdfbox: infinite loop while loading
crafted PDF file
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, bibryam(a)redhat.com,
chazlett(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
hbraun(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jolee(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
mnovotny(a)redhat.com, nwallace(a)redhat.com,
pantinor(a)redhat.com, pjindal(a)redhat.com,
puntogil(a)libero.it, rhel8-maint(a)redhat.com,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
sergio(a)serjux.com, tcunning(a)redhat.com,
tkirby(a)redhat.com
Target Milestone: ---
Classification: Other
A carefully crafted PDF file can trigger an infinite loop while loading the
file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
References:
https://www.openwall.com/lists/oss-security/2021/03/19/9
https://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3...
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 8 months
[Bug 1941050] New: CVE-2021-27906 pdfbox: OutOfMemory-Exception while loading a crafted PDF file
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1941050
Bug ID: 1941050
Summary: CVE-2021-27906 pdfbox: OutOfMemory-Exception while
loading a crafted PDF file
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, bibryam(a)redhat.com,
chazlett(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
hbraun(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jolee(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
mnovotny(a)redhat.com, nwallace(a)redhat.com,
pantinor(a)redhat.com, pjindal(a)redhat.com,
puntogil(a)libero.it, rhel8-maint(a)redhat.com,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
sergio(a)serjux.com, tcunning(a)redhat.com,
tkirby(a)redhat.com
Target Milestone: ---
Classification: Other
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading
the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x
versions.
References:
https://www.openwall.com/lists/oss-security/2021/03/19/9
https://lists.apache.org/thread.html/rf35026148ccc0e1af133501c0d003d05288...
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 8 months
[Bug 1969823] New: F35FailsToInstall: xstream
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1969823
Bug ID: 1969823
Summary: F35FailsToInstall: xstream
Product: Fedora
Version: rawhide
Status: NEW
Component: xstream
Assignee: dchen(a)redhat.com
Reporter: mhroncok(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dchen(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
lkundrak(a)v3.sk, mizdebsk(a)redhat.com
Blocks: 1927313 (F35FailsToInstall,RAWHIDEFailsToInstall)
Target Milestone: ---
Classification: Fedora
Hello,
Please note that this comment was generated automatically. If you feel that
this output has mistakes, please contact me via email (mhroncok(a)redhat.com).
Your package (xstream) Fails To Install in Fedora 35:
can't install xstream:
- nothing provides mvn(xpp3:xpp3) needed by xstream-1.4.14-2.fc34.noarch
- nothing provides mvn(xpp3:xpp3_min) needed by xstream-1.4.14-2.fc34.noarch
If you know about this problem and are planning on fixing it, please
acknowledge so by setting the bug status to ASSIGNED. If you don't have time to
maintain this package, consider orphaning it, so maintainers of dependent
packages realize the problem.
If you don't react accordingly to the policy for FTBFS/FTI bugs
(https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fai...),
your package may be orphaned in 8+ weeks.
P.S. The data was generated solely from koji buildroot, so it might be newer
than the latest compose or the content on mirrors.
P.P.S. If this bug has been reported in the middle of upgrading multiple
dependent packages, please consider using side tags:
https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter...
Thanks!
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1927313
[Bug 1927313] Fedora 35 Fails To install Tracker
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 8 months