https://bugzilla.redhat.com/show_bug.cgi?id=1995259
Bug ID: 1995259
Summary: CVE-2021-37714 jsoup: Crafted input may cause the
jsoup HTML and XML parser to get stuck
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
ataylor(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bgeorges(a)redhat.com,
bibryam(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, clement.escoffier(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eleandro(a)redhat.com, etirelli(a)redhat.com,
fjuma(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gsmet(a)redhat.com,
gvarsami(a)redhat.com, hamadhan(a)redhat.com,
hbraun(a)redhat.com, hhorak(a)redhat.com, ibek(a)redhat.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jjoyce(a)redhat.com,
jnethert(a)redhat.com, jochrist(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jrokos(a)redhat.com, jross(a)redhat.com,
jschatte(a)redhat.com, jschluet(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kaycoth(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lthon(a)redhat.com, mburns(a)redhat.com,
mizdebsk(a)redhat.com, mkolesni(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
nwallace(a)redhat.com, pantinor(a)redhat.com,
pdrozd(a)redhat.com, peholase(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, probinso(a)redhat.com,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rwagner(a)redhat.com,
sbiarozk(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdouglas(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
sthorger(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com, tom.jenkinson(a)redhat.com,
tzimanyi(a)redhat.com, yborgess(a)redhat.com
Target Milestone: ---
Classification: Other
jsoup is a Java library for working with HTML. Those using jsoup versions prior
to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If
the parser is run on user supplied input, an attacker may supply content that
causes the parser to get stuck (loop indefinitely until cancelled), to complete
more slowly than usual, or to throw an unexpected exception. This effect may
support a denial of service attack. The issue is patched in version 1.14.2.
There are a few available workarounds. Users may rate limit input parsing,
limit the size of inputs based on system resources, and/or implement thread
watchdogs to cap and timeout parse runtimes.
References:
https://jsoup.org/news/release-1.14.1https://jsoup.org/news/release-1.14.2https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1815495
Bug ID: 1815495
Summary: CVE-2020-10672 jackson-databind: mishandles the
interaction between serialization gadgets and typing
which could result in remote command execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mkaplan(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
ataylor(a)redhat.com, avibelli(a)redhat.com,
bgeorges(a)redhat.com, chazlett(a)redhat.com,
decathorpe(a)gmail.com, dkreling(a)redhat.com,
drieden(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jbalunas(a)redhat.com, jochrist(a)redhat.com,
jolee(a)redhat.com, jpallich(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, lef(a)fedoraproject.org,
lthon(a)redhat.com, mnovotny(a)redhat.com,
mszynkie(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, puntogil(a)libero.it,
rhcs-maint(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rsynek(a)redhat.com,
sdaley(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
jackson-databind: mishandles the interaction between serialization gadgets and
typing, related to
org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory which could
result in remote command execution
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1847573
Bug ID: 1847573
Summary: Please provide antlr3 version for EPEL8
Product: Fedora EPEL
Version: epel8
Status: NEW
Component: antlr3
Assignee: dingyichen(a)gmail.com
Reporter: minfrin(a)sharp.fm
QA Contact: extras-qa(a)fedoraproject.org
CC: dingyichen(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
loganjerry(a)gmail.com, mizdebsk(a)redhat.com,
walters(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
Version not available for EPEL8.
Version-Release number of selected component (if applicable):
None.
How reproducible:
Always.
Steps to Reproduce:
1. dnf install antlr3-C-devel
Actual results:
Error: Unable to find a match: antlr3-C-devel
Expected results:
Package installed.
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1884968
Bug ID: 1884968
Summary: cdi-api-2.0.1 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: cdi-api
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
Latest upstream release: 2.0.1
Current version/release in rawhide: 2.0-1.fc34
URL: http://cdi-spec.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/20387/
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1884967
Bug ID: 1884967
Summary: atinject-2.0.0-RC2 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: atinject
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, sochotni(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 2.0.0-RC2
Current version/release in rawhide: 1-35.20100611svn86.fc33
URL: http://javax-inject.github.io/javax-inject/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/129/
--
You are receiving this mail because:
You are on the CC list for the bug.