[Bug 2063869] New: Please provide google-gson for EPEL-9
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2063869
Bug ID: 2063869
Summary: Please provide google-gson for EPEL-9
Product: Fedora EPEL
Version: epel9
Status: NEW
Component: google-gson
Assignee: mat.booth(a)gmail.com
Reporter: fedoraproject.org(a)bluhm-de.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dchen(a)redhat.com, jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com,
mat.booth(a)gmail.com, mizdebsk(a)redhat.com,
sergio(a)serjux.com
Target Milestone: ---
Classification: Fedora
Can you please provide google-gson for EPEL-9?
There is the missing dependency 'bnd-maven-plugin' provided by package
aqute-bnd which fails a scratch build.
Thank you very much!
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2063869
8 months, 2 weeks
[Bug 1997772] New: CVE-2021-39144 xstream: vulnerable to a remote command execution attack
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1997772
Bug ID: 1997772
Summary: CVE-2021-39144 xstream: vulnerable to a remote command
execution attack
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: abenaiss(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, ataylor(a)redhat.com,
bibryam(a)redhat.com, bmontgom(a)redhat.com,
chazlett(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
extras-orphan(a)fedoraproject.org,
fedoraproject.org(a)bluhm-de.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gvarsami(a)redhat.com,
hbraun(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jcoleman(a)redhat.com,
jnethert(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jrokos(a)redhat.com, jross(a)redhat.com,
jschatte(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lkundrak(a)v3.sk,
mizdebsk(a)redhat.com, mnovotny(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
pantinor(a)redhat.com, pbhattac(a)redhat.com,
pdelbell(a)redhat.com, pjindal(a)redhat.com,
rrajasek(a)redhat.com, rwagner(a)redhat.com,
sponnaga(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com, tzimanyi(a)redhat.com
Target Milestone: ---
Classification: Other
XStream is a simple library to serialize objects to XML and back again. In
affected versions this vulnerability may allow a remote attacker has sufficient
rights to execute commands of the host only by manipulating the processed input
stream. No user is affected, who followed the recommendation to setup XStream's
security framework with a whitelist limited to the minimal required types.
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be
secured for general purpose.
References:
https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh
https://x-stream.github.io/CVE-2021-39144.html
--
You are receiving this mail because:
You are on the CC list for the bug.
9 months
[Bug 2049784] New: CVE-2021-43859 xstream: Injecting highly recursive collections or maps can cause a DoS [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2049784
Bug ID: 2049784
Summary: CVE-2021-43859 xstream: Injecting highly recursive
collections or maps can cause a DoS [fedora-all]
Product: Fedora
Version: 35
Status: NEW
Component: xstream
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: didiksupriadi41(a)gmail.com
Reporter: gsuckevi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: didiksupriadi41(a)gmail.com,
fedoraproject.org(a)bluhm-de.com,
java-sig-commits(a)lists.fedoraproject.org,
lkundrak(a)v3.sk, mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2049784
9 months, 1 week
[Bug 2087214] New: CVE-2022-22976 springframework: BCrypt skips salt rounds for work factor of 31
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2087214
Bug ID: 2087214
Summary: CVE-2022-22976 springframework: BCrypt skips salt
rounds for work factor of 31
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: saroy(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, chazlett(a)redhat.com,
dchen(a)redhat.com, drieden(a)redhat.com,
emingora(a)redhat.com, etirelli(a)redhat.com,
extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jochrist(a)redhat.com, jolee(a)redhat.com,
jrokos(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
mnovotny(a)redhat.com, pdelbell(a)redhat.com,
pjindal(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
tzimanyi(a)redhat.com
Target Milestone: ---
Classification: Other
Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and
earlier unsupported versions contain an integer overflow vulnerability. When
using the BCrypt class with the maximum work factor (31), the encoder does not
perform any salt rounds, due to an integer overflow error.
The default settings are not affected by this CVE.
Only in circumstances where the BCryptPasswordEncoder has been configured with
the maximum work factor are affected. Due to current limitations in computer
hardware, the use of such a high work factor is computationally impractical.
https://tanzu.vmware.com/security/cve-2022-22976
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2087214
9 months, 1 week
[Bug 2014356] New: CVE-2021-42340 tomcat: OutOfMemoryError caused by HTTP upgrade connection leak could lead to DoS
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2014356
Bug ID: 2014356
Summary: CVE-2021-42340 tomcat: OutOfMemoryError caused by HTTP
upgrade connection leak could lead to DoS
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: jwon(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, alee(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bgeorges(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, cmoulliard(a)redhat.com,
coolsvap(a)gmail.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, eleandro(a)redhat.com,
etirelli(a)redhat.com, fjuma(a)redhat.com,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
gzaronikas(a)gmail.com, gzaronik(a)redhat.com,
huwang(a)redhat.com, ibek(a)redhat.com,
ikanello(a)redhat.com, ivan.afonichev(a)gmail.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jclere(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jolee(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jrokos(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, krathod(a)redhat.com,
krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lthon(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, nwallace(a)redhat.com,
pdelbell(a)redhat.com, peholase(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, slinaber(a)redhat.com,
smaestri(a)redhat.com, szappis(a)redhat.com,
tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com,
yborgess(a)redhat.com
Blocks: 2014348
Target Milestone: ---
Classification: Other
Apache Tomcat did not properly release an HTTP upgrade connection for WebSocket
connections once the WebSocket connection was closed. This created a memory
leak that, over time, could lead to a denial of service via an
OutOfMemoryError. This issue affects the version of Apache Tomcat 10.1.0-M1 to
10.1.0-M5; Apache Tomcat 10.0.0-M10 to 10.0.11; Apache Tomcat 9.0.40 to 9.0.53;
Apache Tomcat 8.5.60 to 8.5.71.
Upstream commits:
Tomcat 10.1:
https://github.com/apache/tomcat/commit/d5a6660cba7f51589468937bf3bbad4db...
Tomcat 10.0:
https://github.com/apache/tomcat/commit/31d62426645824bdfe076a0c0eafa904d...
Tomcat 9.0:
https://github.com/apache/tomcat/commit/80f1438ec45e77a07b96419808971838d...
Tomcat 8.5:
https://github.com/apache/tomcat/commit/d27535bdee95d252418201eb21e9d2947...
Reference:
https://lists.apache.org/thread.html/r83a35be60f06aca2065f188ee542b909969...
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2014356
9 months, 2 weeks