java-sig-commits January 2023

java-sig-commits@lists.fedoraproject.org

1 participants
255 discussions

[Bug 1801382] New: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation [epel-7]
by bugzilla＠redhat.com 09 Jul '24

09 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1801382 Bug ID: 1801382 Summary: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: cryptacular Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: lef(a)fedoraproject.org Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-7. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1709860] New: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service
by bugzilla＠redhat.com 09 Jul '24

09 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1709860 Bug ID: 1709860 Summary: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190417,reported=20190424,sour ce=cve,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/ I:N/A:H,cwe=CWE-776,fedora-all/c3p0=affected,epel-7/c3 p0=affected,rhes-3/c3p0=new,rhpam-7/c3p0=new,fuse-6/c3 p0=new,fuse-7/c3p0=new,rhn_satellite_6/c3p0=new,jbews- 2/c3p0=new,rhn_satellite_5/c3p0=new,rhmap-4/c3p0=new,v ertx-3/c3p0=new,soap-5/c3p0=new,bpms-6/c3p0=new Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: msiddiqu(a)redhat.com CC: aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, avibelli(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, btotty(a)redhat.com, cbyrne(a)redhat.com, chazlett(a)redhat.com, cmacedo(a)redhat.com, csutherl(a)redhat.com, decathorpe(a)gmail.com, dffrench(a)redhat.com, dingyichen(a)gmail.com, drusso(a)redhat.com, etirelli(a)redhat.com, ggainey(a)redhat.com, gvarsami(a)redhat.com, gzaronik(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jmadigan(a)redhat.com, jochrist(a)redhat.com, jpallich(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, lpetrovi(a)redhat.com, lthon(a)redhat.com, mat.booth(a)redhat.com, mbabacek(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, mszynkie(a)redhat.com, myarboro(a)redhat.com, ngough(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pgallagh(a)redhat.com, ppenicka(a)redhat.com, pwright(a)redhat.com, rchan(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sdaley(a)redhat.com, sisharma(a)redhat.com, smohan(a)redhat.com, ssaha(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org, tcunning(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, trepel(a)redhat.com, trogers(a)redhat.com, twalsh(a)redhat.com, vbellur(a)redhat.com, weli(a)redhat.com Target Milestone: --- Classification: Other c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration. References: https://hackerone.com/reports/509315 http://www.cvedetails.com/cve/CVE-2019-5427/ Upstream commit: https://github.com/swaldman/c3p0/commit/f38f27635c384806c2a9d6500d80183d9f0… -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1709862] New: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service [epel-7]
by bugzilla＠redhat.com 09 Jul '24

09 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1709862 Bug ID: 1709862 Summary: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: c3p0 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: dingyichen(a)gmail.com Reporter: msiddiqu(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, dingyichen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, mat.booth(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-7. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1664731] New: CVE-2018-20433 c3p0: XML external entity processing in extractXmlConfigFromInputStream [epel-7]
by bugzilla＠redhat.com 09 Jul '24

09 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1664731 Bug ID: 1664731 Summary: CVE-2018-20433 c3p0: XML external entity processing in extractXmlConfigFromInputStream [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: c3p0 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: dingyichen(a)gmail.com Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dingyichen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, mat.booth(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-7. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1748421] New: httpcomponents-core-4.4.12 is available
by bugzilla＠redhat.com 03 Jul '24

03 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1748421 Bug ID: 1748421 Summary: httpcomponents-core-4.4.12 is available Product: Fedora Version: rawhide Status: NEW Component: httpcomponents-core Keywords: FutureFeature, Triaged Assignee: stuart(a)gathman.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com, sochotni(a)redhat.com, stuart(a)gathman.org Target Milestone: --- Classification: Fedora Latest upstream release: 4.4.12 Current version/release in rawhide: 4.4.10-6.fc31 URL: http://www.apache.org/dist/httpcomponents/httpcore/source/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1333/ -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 2129818] New: snakeyaml-1.33 is available
by bugzilla＠redhat.com 21 Jun '24

21 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=2129818 Bug ID: 2129818 Summary: snakeyaml-1.33 is available Product: Fedora Version: rawhide Status: NEW Component: snakeyaml Keywords: FutureFeature, Triaged Assignee: jerboaa(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: fedoraproject.org(a)bluhm-de.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, mizdebsk(a)redhat.com, mo(a)morsi.org Target Milestone: --- Classification: Fedora Releases retrieved: 1.33 Upstream release that is considered latest: 1.33 Current version/release in rawhide: 1.32-1.fc38 URL: https://bitbucket.org/asomov/snakeyaml/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/4842/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/snakeyaml -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2129818

1 4

[Bug 2158760] New: CVE-2022-45143 tomcat: JsonErrorReportValve injection [epel-all]
by bugzilla＠redhat.com 18 Jun '24

18 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=2158760 Bug ID: 2158760 Summary: CVE-2022-45143 tomcat: JsonErrorReportValve injection [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: tomcat Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: csutherl(a)redhat.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2158695 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2158760

1 5

[Bug 1870860] New: auto-1.7.4 is available
by bugzilla＠redhat.com 02 Jun '24

02 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=1870860 Bug ID: 1870860 Summary: auto-1.7.4 is available Product: Fedora Version: rawhide Status: NEW Component: auto Keywords: FutureFeature, Triaged Assignee: mat.booth(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, mat.booth(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Latest upstream release: 1.7.4 Current version/release in rawhide: 1.5.4-4.fc33 URL: https://github.com/google/auto Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/6371/ -- You are receiving this mail because: You are on the CC list for the bug.

1 33

[Bug 2064698] New: CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects
by bugzilla＠redhat.com 22 May '24

22 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2064698 Bug ID: 2064698 Summary: CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mrehak(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, alazarot(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, ataylor(a)redhat.com, bbaranow(a)redhat.com, bibryam(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, boliveir(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, cdorney(a)redhat.com, cfu(a)redhat.com, chazlett(a)redhat.com, ckelley(a)redhat.com, darran.lofthouse(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, edewata(a)redhat.com, emingora(a)redhat.com, eparis(a)redhat.com, eric.wittmann(a)redhat.com, etirelli(a)redhat.com, fjuma(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, hbraun(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jmagne(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jrokos(a)redhat.com, jross(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, lgao(a)redhat.com, mharmsen(a)redhat.com, mnovotny(a)redhat.com, mosmerov(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, pantinor(a)redhat.com, pdelbell(a)redhat.com, pdrozd(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rhcs-maint(a)redhat.com, rrajasek(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, smaestri(a)redhat.com, sponnaga(a)redhat.com, sthorger(a)redhat.com, swoodman(a)redhat.com, tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com Target Milestone: --- Classification: Other A Java StackOverflow exception and denial of service via a large depth of nested objects. Reference: https://github.com/FasterXML/jackson-databind/issues/2816 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064698

1 62

[Bug 2160814] New: CVE-2022-46456 nasm: buffer overflow in dbgdbg_typevalue() in output/outdbg.c [fedora-all]
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2160814 Bug ID: 2160814 Summary: CVE-2022-46456 nasm: buffer overflow in dbgdbg_typevalue() in output/outdbg.c [fedora-all] Product: Fedora Version: 37 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2160807 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2160814

1 6

← Newer
1
2
3
4
5
6
7
...
26
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits January 2023