[Bug 1982336] New: CVE-2021-36373 ant: excessive memory allocation when reading a specially crafted TAR archive
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1982336
Bug ID: 1982336
Summary: CVE-2021-36373 ant: excessive memory allocation when
reading a specially crafted TAR archive
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: abenaiss(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, bbaranow(a)redhat.com,
bibryam(a)redhat.com, bmaxwell(a)redhat.com,
bmontgom(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eleandro(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, fjuma(a)redhat.com,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
gvarsami(a)redhat.com, hbraun(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com, jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcoleman(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jrokos(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, loleary(a)redhat.com,
mizdebsk(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msrb(a)redhat.com,
msvehla(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, pantinor(a)redhat.com,
pbhattac(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rwagner(a)redhat.com,
sd-operator-metering(a)redhat.com, smaestri(a)redhat.com,
spinder(a)redhat.com, sponnaga(a)redhat.com,
tcunning(a)redhat.com, tflannag(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com,
vbobade(a)redhat.com, yborgess(a)redhat.com
Target Milestone: ---
Classification: Other
When reading a specially crafted TAR archive an Apache Ant build can be made to
allocate large amounts of memory that finally leads to an out of memory error,
even for small inputs. This can be used to disrupt builds using Apache Ant.
Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Reference:
https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b...
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 8 months
[Bug 1981903] New: CVE-2021-35517 apache-commons-compress: excessive memory allocation when reading a specially crafted TAR archive
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1981903
Bug ID: 1981903
Summary: CVE-2021-35517 apache-commons-compress: excessive
memory allocation when reading a specially crafted TAR
archive
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: dblechte(a)redhat.com, dfediuck(a)redhat.com,
eedri(a)redhat.com, hhorak(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jorton(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com,
mkoncek(a)redhat.com, sbonazzo(a)redhat.com,
sherold(a)redhat.com, SpikeFedora(a)gmail.com,
yturgema(a)redhat.com
Target Milestone: ---
Classification: Other
When reading a specially crafted TAR archive, Compress can be made to allocate
large amounts of memory that finally leads to an out of memory error even for
very small inputs. This could be used to mount a denial of service attack
against services that use Compress' tar package.
References:
https://commons.apache.org/proper/commons-compress/security-reports.html
https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f66...
http://www.openwall.com/lists/oss-security/2021/07/13/3
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 8 months
[Bug 1981909] New: CVE-2021-36090 apache-commons-compress: excessive memory allocation when reading a specially crafted ZIP archive
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1981909
Bug ID: 1981909
Summary: CVE-2021-36090 apache-commons-compress: excessive
memory allocation when reading a specially crafted ZIP
archive
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: dblechte(a)redhat.com, dfediuck(a)redhat.com,
eedri(a)redhat.com, hhorak(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jorton(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com,
mkoncek(a)redhat.com, sbonazzo(a)redhat.com,
sherold(a)redhat.com, SpikeFedora(a)gmail.com,
yturgema(a)redhat.com
Target Milestone: ---
Classification: Other
When reading a specially crafted ZIP archive, Compress can be made to allocate
large amounts of memory that finally leads to an out of memory error even for
very small inputs. This could be used to mount a denial of service attack
against services that use Compress' zip package.
References:
https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f22055311227324...
https://commons.apache.org/proper/commons-compress/security-reports.html
http://www.openwall.com/lists/oss-security/2021/07/13/4
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 8 months
[Bug 1981900] New: CVE-2021-35516 apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1981900
Bug ID: 1981900
Summary: CVE-2021-35516 apache-commons-compress: excessive
memory allocation when reading a specially crafted 7Z
archive
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: dblechte(a)redhat.com, dfediuck(a)redhat.com,
eedri(a)redhat.com, hhorak(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jorton(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com,
mkoncek(a)redhat.com, sbonazzo(a)redhat.com,
sherold(a)redhat.com, SpikeFedora(a)gmail.com,
yturgema(a)redhat.com
Target Milestone: ---
Classification: Other
When reading a specially crafted 7Z archive, Compress can be made to allocate
large amounts of memory that finally leads to an out of memory error even for
very small inputs. This could be used to mount a denial of service attack
against services that use Compress' sevenz package.
References:
https://commons.apache.org/proper/commons-compress/security-reports.html
https://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c...
http://www.openwall.com/lists/oss-security/2021/07/13/2
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 8 months
[Bug 1981895] New: CVE-2021-35515 apache-commons-compress: infinite loop when reading a specially crafted 7Z archive
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1981895
Bug ID: 1981895
Summary: CVE-2021-35515 apache-commons-compress: infinite loop
when reading a specially crafted 7Z archive
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: dblechte(a)redhat.com, dfediuck(a)redhat.com,
eedri(a)redhat.com, hhorak(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jorton(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com,
mkoncek(a)redhat.com, sbonazzo(a)redhat.com,
sherold(a)redhat.com, SpikeFedora(a)gmail.com,
yturgema(a)redhat.com
Target Milestone: ---
Classification: Other
When reading a specially crafted 7Z archive, the construction of the list of
codecs that decompress an entry can result in an infinite loop. This could be
used to mount a denial of service attack against services that use Compress'
sevenz package.
References:
https://commons.apache.org/proper/commons-compress/security-reports.html
https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3...
http://www.openwall.com/lists/oss-security/2021/07/13/1
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 8 months
[Bug 2051205] New: rachota fails to build with java-17-openjdk
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2051205
Bug ID: 2051205
Summary: rachota fails to build with java-17-openjdk
Product: Fedora
Version: rawhide
Status: NEW
Component: rachota
Severity: high
Assignee: sebastien.willmann(a)gmail.com
Reporter: jvanek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: didiksupriadi41(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jhuttana(a)redhat.com, jvanek(a)redhat.com,
pmikova(a)redhat.com, sebastien.willmann(a)gmail.com,
sgehwolf(a)redhat.com
Blocks: 2024265
Target Milestone: ---
Classification: Fedora
rachota fails to build with java-17-openjdk as sytem JDK. See
https://fedoraproject.org/wiki/Changes/Java17 .
See especially part about known failures:
https://fedoraproject.org/wiki/Changes/Java17#common_issues_packagers_can...
For the build logs, see:
https://koji.fedoraproject.org/koji/taskinfo?taskID=82434091
https://kojipkgs.fedoraproject.org/work/tasks/4231/82434231/mock_output.log
https://kojipkgs.fedoraproject.org/work/tasks/4231/82434231/hw_info.log
https://kojipkgs.fedoraproject.org/work/tasks/4231/82434231/state.log
https://kojipkgs.fedoraproject.org/work/tasks/4231/82434231/build.log
https://kojipkgs.fedoraproject.org/work/tasks/4231/82434231/root.log
We run the rebuild in side tag f36-java17, but as fail ratio was small, we
expect this side tag to be merged into rawhide 7 or 8 of February 2022.
To reproduce before this date simply: fedpkg clone rachota; cd rachota; fedpkg
build --target f36-java17; #The target is crucial.
After this date the usual fedpkg build in f36 and up should do.
We run two reruns your package failed both.
We had also run the mass rebuilds in copr since November. We keep all
encountered failures. See them here:
https://copr.fedorainfracloud.org/coprs/jvanek/java17//package/rachota
You may find interesting additional informations here. Also we were spamming
maintainers regualrly, check you spam folder.
We had tried aprox 500 packages, and aprox 65 had failed, so the
java-17-openjdk will be system JDK in f36, and you should fix your package if
you want to keep it alive. Usually the fix is simple, and best is to update the
package to latest upstream version.
There will be usual mass rebuild once f36 branches. You may got another FTBFS
bug.
Let us know here if you have any questions, here in bug, or at
java-devel(a)lists.fedoraproject.org .
We'd appreciate help from the people who know this package best, but if you
don't want to work on this now, let us know so we can try to work around it on
our side if needed.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2024265
[Bug 2024265] java-17-openjdk as system JDK in F36
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2051205
1 year, 8 months
[Bug 1987678] New: lucene: FTBFS in Fedora rawhide/f35
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1987678
Bug ID: 1987678
Summary: lucene: FTBFS in Fedora rawhide/f35
Product: Fedora
Version: rawhide
Status: NEW
Component: lucene
Assignee: akurtako(a)redhat.com
Reporter: releng(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, dbhole(a)redhat.com,
dchen(a)redhat.com, eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com,
lef(a)fedoraproject.org, rgrunber(a)redhat.com
Blocks: 1927309 (F35FTBFS,RAWHIDEFTBFS)
Target Milestone: ---
Classification: Fedora
lucene failed to build from source in Fedora rawhide/f35
https://koji.fedoraproject.org/koji/taskinfo?taskID=72400674
For details on the mass rebuild see:
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
Please fix lucene at your earliest convenience and set the bug's status to
ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks,
lucene will be orphaned. Before branching of Fedora 36,
lucene will be retired, if it still fails to build.
For more details on the FTBFS policy, please visit:
https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fai...
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1927309
[Bug 1927309] Fedora 35 FTBFS Tracker
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 8 months
[Bug 1996787] New: objectweb-asm has missing osgi metadata since the upgrade to 9.1
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1996787
Bug ID: 1996787
Summary: objectweb-asm has missing osgi metadata since the
upgrade to 9.1
Product: Fedora
Version: rawhide
Status: NEW
Component: objectweb-asm
Assignee: mizdebsk(a)redhat.com
Reporter: sergio(a)serjux.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dwalluck(a)redhat.com, fnasser(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
objectweb-asm has missing osgi metadata since the upgrade to 9.1
Version-Release number of selected component (if applicable):
objectweb-asm-9.1-3.fc35.noarch.rpm
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 9 months