https://bugzilla.redhat.com/show_bug.cgi?id=2141334
Bug ID: 2141334
Summary: CVE-2022-42252 tomcat: request smuggling [fedora-all]
Product: Fedora
Version: 36
Status: NEW
Component: tomcat
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: csutherl(a)redhat.com
Reporter: pdelbell(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, gzaronikas(a)gmail.com,
huwang(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2141329
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2141334
https://bugzilla.redhat.com/show_bug.cgi?id=2133650
Bug ID: 2133650
Summary: CVE-2021-43980 tomcat: : Apache Tomcat: Information
disclosure [fedora-all]
Product: Fedora
Version: 36
Status: NEW
Component: tomcat
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: csutherl(a)redhat.com
Reporter: trathi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, gzaronikas(a)gmail.com,
huwang(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2133650
https://bugzilla.redhat.com/show_bug.cgi?id=2106477
Bug ID: 2106477
Summary: Warning about uid on installation of tomcat package
Product: Fedora
Version: 36
Status: NEW
Component: tomcat
Assignee: csutherl(a)redhat.com
Reporter: csutherl(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, gzaronikas(a)gmail.com,
huwang(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Fedora
Description of problem:
The scriplet that sets up the uid for tomcat throws a warning.
Version-Release number of selected component (if applicable):
tomcat-1:9.0.64-1.fc36.noarch
How reproducible:
Every time
Steps to Reproduce:
1. Install tomcat
2. Observe dnf output for warning message
Actual results:
You will see the following warning:
```
Running scriptlet: tomcat-1:9.0.64-1.fc36.noarch
useradd warning: tomcat's uid 53 outside of the SYS_UID_MIN 201 and SYS_UID_MAX
999 range.
```
Expected results:
There is no warning.
Additional info:
I found https://bugzilla.redhat.com/show_bug.cgi?id=2004911#c3 while searching
around a bit which implies it may be 'fixed' some time? We could also just drop
the UID as I don't think it's required anywhere...
Also the tomcat ID is still reserved as 53 in /usr/share/doc/setup/uidgid
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2106477
https://bugzilla.redhat.com/show_bug.cgi?id=2127082
Bug ID: 2127082
Summary: CVE-2022-36033 jsoup: The jsoup cleaner may
incorrectly sanitize crafted XSS attempts if
SafeList.preserveRelativeLinks is enabled [fedora-all]
Product: Fedora
Version: 36
Status: NEW
Component: jsoup
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: extras-orphan(a)fedoraproject.org
Reporter: saroy(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: extras-orphan(a)fedoraproject.org,
jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2127082