https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Bug ID: 1508129 Summary: CVE-2016-5004 xmlrpc: XSS in Content-Encoding HTTP header of xmlrpc Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team@redhat.com Reporter: psampaio@redhat.com CC: abhgupta@redhat.com, bmcclain@redhat.com, dbhole@redhat.com, dblechte@redhat.com, dwalluck@redhat.com, eedri@redhat.com, hhorak@redhat.com, java-maint@redhat.com, java-sig-commits@lists.fedoraproject.org, jorton@redhat.com, krzysztof.daniel@gmail.com, kseifried@redhat.com, mgoldboi@redhat.com, michal.skrivanek@redhat.com, mizdebsk@redhat.com, msimacek@redhat.com, puntogil@libero.it, sbonazzo@redhat.com, sherold@redhat.com, sochotni@redhat.com, tiwillia@redhat.com, ykaul@redhat.com, ylavi@redhat.com
The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.
References:
http://www.openwall.com/lists/oss-security/2016/07/12/5 https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Pedro Sampaio psampaio@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1508131
--- Comment #1 from Pedro Sampaio psampaio@redhat.com --- Created xmlrpc tracking bugs for this issue:
Affects: fedora-all [bug 1508131]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1508131 [Bug 1508131] CVE-2016-5004 xmlrpc: XSS in Content-Encoding HTTP header of xmlrpc [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1508328
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Andrej Nemec anemec@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|abhgupta@redhat.com, |sisharma@redhat.com, |kseifried@redhat.com, |smohan@redhat.com, |tiwillia@redhat.com |ssaha@redhat.com, | |vbellur@redhat.com Whiteboard|impact=low,public=20160524, |impact=low,public=20160524, |reported=20160524,source=cv |reported=20160524,source=cv |e,cvss3=5.0/CVSS:3.0/AV:N/A |e,cvss3=5.0/CVSS:3.0/AV:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |:L,cwe=CWE-79,fedora-all/xm |:L,cwe=CWE-79,fedora-all/xm |lrpc=affected,rhel-5/xmlrpc |lrpc=affected,rhel-5/xmlrpc |=new,rhel-6/xmlrpc3=new,rhe |=new,rhel-6/xmlrpc3=new,rhe |l-7/xmlrpc=new,rhev-m-4/xml |l-7/xmlrpc=new,rhev-m-4/xml |rpc=new,rhev-m-4/xmlrpc-com |rpc=new,rhev-m-4/xmlrpc-com |mon=new,rhev-m-3/xmlrpc-com |mon=new,rhev-m-3/xmlrpc-com |mon=new,rhscl-2/rh-java-com |mon=new,rhscl-3/rh-java-com |mon-xmlrpc=new,storage-cons |mon-xmlrpc=new,rhscon-2/xml |ole-2/xmlrpc-common=new,sto |rpc-common=new,rhes-3/xmlrp |rage-3/xmlrpc-common=new,jb |c-common=new,jbds-8/xmlrpc= |ds-8/xmlrpc=new,jbds-10/xml |new,jbds-10/xmlrpc=new,fuse |rpc=new,fuse-6/camel-xmlrpc |-6/camel-xmlrpc=new |=new,openshift-enterprise-2 | |/camel-xmlrpc=new,dts-2/xml | |rpc=new,dts-3/xmlrpc=new |
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Siddharth Sharma sisharma@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160524, |impact=low,public=20160524, |reported=20160524,source=cv |reported=20160524,source=cv |e,cvss3=5.0/CVSS:3.0/AV:N/A |e,cvss3=5.0/CVSS:3.0/AV:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |:L,cwe=CWE-79,fedora-all/xm |:L,cwe=CWE-79,fedora-all/xm |lrpc=affected,rhel-5/xmlrpc |lrpc=affected,rhel-5/xmlrpc |=new,rhel-6/xmlrpc3=new,rhe |=new,rhel-6/xmlrpc3=new,rhe |l-7/xmlrpc=new,rhev-m-4/xml |l-7/xmlrpc=new,rhev-m-4/xml |rpc=new,rhev-m-4/xmlrpc-com |rpc=new,rhev-m-4/xmlrpc-com |mon=new,rhev-m-3/xmlrpc-com |mon=new,rhev-m-3/xmlrpc-com |mon=new,rhscl-3/rh-java-com |mon=new,rhscl-3/rh-java-com |mon-xmlrpc=new,rhscon-2/xml |mon-xmlrpc=new,rhes-3/xmlrp |rpc-common=new,rhes-3/xmlrp |c-common=new,jbds-8/xmlrpc= |c-common=new,jbds-8/xmlrpc= |new,jbds-10/xmlrpc=new,fuse |new,jbds-10/xmlrpc=new,fuse |-6/camel-xmlrpc=new |-6/camel-xmlrpc=new |
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Siddharth Sharma sisharma@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160524, |impact=low,public=20160524, |reported=20160524,source=cv |reported=20160524,source=cv |e,cvss3=5.0/CVSS:3.0/AV:N/A |e,cvss3=5.0/CVSS:3.0/AV:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |:L,cwe=CWE-79,fedora-all/xm |:L,cwe=CWE-79,fedora-all/xm |lrpc=affected,rhel-5/xmlrpc |lrpc=affected,rhel-5/xmlrpc |=new,rhel-6/xmlrpc3=new,rhe |=new,rhel-6/xmlrpc3=new,rhe |l-7/xmlrpc=new,rhev-m-4/xml |l-7/xmlrpc=new,rhev-m-4/xml |rpc=new,rhev-m-4/xmlrpc-com |rpc=new,rhev-m-4/xmlrpc-com |mon=new,rhev-m-3/xmlrpc-com |mon=new,rhev-m-3/xmlrpc-com |mon=new,rhscl-3/rh-java-com |mon=new,rhscl-3/rh-java-com |mon-xmlrpc=new,rhes-3/xmlrp |mon-xmlrpc=new,rhes-3/xmlrp |c-common=new,jbds-8/xmlrpc= |c-common=wontfix,jbds-8/xml |new,jbds-10/xmlrpc=new,fuse |rpc=new,jbds-10/xmlrpc=new, |-6/camel-xmlrpc=new |fuse-6/camel-xmlrpc=new
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160524, |impact=low,public=20160524, |reported=20160524,source=cv |reported=20160524,source=cv |e,cvss3=5.0/CVSS:3.0/AV:N/A |e,cvss3=5.0/CVSS:3.0/AV:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |:L,cwe=CWE-79,fedora-all/xm |:L,cwe=CWE-79,fedora-all/xm |lrpc=affected,rhel-5/xmlrpc |lrpc=affected,rhel-5/xmlrpc |=new,rhel-6/xmlrpc3=new,rhe |=wontfix,rhel-6/xmlrpc3=won |l-7/xmlrpc=new,rhev-m-4/xml |tfix,rhel-7/xmlrpc=affected |rpc=new,rhev-m-4/xmlrpc-com |,rhev-m-3/xmlrpc-common=won |mon=new,rhev-m-3/xmlrpc-com |tfix,rhscl-3/rh-java-common |mon=new,rhscl-3/rh-java-com |-xmlrpc=new,rhes-3/xmlrpc-c |mon-xmlrpc=new,rhes-3/xmlrp |ommon=wontfix,jbds-8/xmlrpc |c-common=wontfix,jbds-8/xml |=new,jbds-10/xmlrpc=new,fus |rpc=new,jbds-10/xmlrpc=new, |e-6/camel-xmlrpc=new |fuse-6/camel-xmlrpc=new |
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Doran Moppert dmoppert@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160524, |impact=low,public=20160524, |reported=20160524,source=cv |reported=20160524,source=cv |e,cvss3=5.0/CVSS:3.0/AV:N/A |e,cvss3=5.0/CVSS:3.0/AV:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |:L,cwe=CWE-79,fedora-all/xm |:L,cwe=CWE-79,fedora-all/xm |lrpc=affected,rhel-5/xmlrpc |lrpc=affected,rhel-5/xmlrpc |=wontfix,rhel-6/xmlrpc3=won |=wontfix,rhel-6/xmlrpc3=won |tfix,rhel-7/xmlrpc=affected |tfix,rhel-7/xmlrpc=wontfix, |,rhev-m-3/xmlrpc-common=won |rhev-m-3/xmlrpc-common=wont |tfix,rhscl-3/rh-java-common |fix,rhscl-3/rh-java-common- |-xmlrpc=new,rhes-3/xmlrpc-c |xmlrpc=new,rhes-3/xmlrpc-co |ommon=wontfix,jbds-8/xmlrpc |mmon=wontfix,jbds-8/xmlrpc= |=new,jbds-10/xmlrpc=new,fus |new,jbds-10/xmlrpc=new,fuse |e-6/camel-xmlrpc=new |-6/camel-xmlrpc=new
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160524, |impact=low,public=20160524, |reported=20160524,source=cv |reported=20160524,source=cv |e,cvss3=5.0/CVSS:3.0/AV:N/A |e,cvss3=5.0/CVSS:3.0/AV:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |:L,cwe=CWE-79,fedora-all/xm |:L,cwe=CWE-79,fedora-all/xm |lrpc=affected,rhel-5/xmlrpc |lrpc=affected,rhel-5/xmlrpc |=wontfix,rhel-6/xmlrpc3=won |=wontfix,rhel-6/xmlrpc3=won |tfix,rhel-7/xmlrpc=wontfix, |tfix,rhel-7/xmlrpc=wontfix, |rhev-m-3/xmlrpc-common=wont |rhev-m-3/xmlrpc-common=wont |fix,rhscl-3/rh-java-common- |fix,rhscl-3/rh-java-common- |xmlrpc=new,rhes-3/xmlrpc-co |xmlrpc=new,rhes-3/xmlrpc-co |mmon=wontfix,jbds-8/xmlrpc= |mmon=wontfix,jbds-8/xmlrpc= |new,jbds-10/xmlrpc=new,fuse |notaffected,jbds-10/xmlrpc= |-6/camel-xmlrpc=new |notaffected,fuse-6/camel-xm | |lrpc=new
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Hooman Broujerdi hghasemb@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |hghasemb@redhat.com Whiteboard|impact=low,public=20160524, |impact=low,public=20160524, |reported=20160524,source=cv |reported=20160524,source=cv |e,cvss3=5.0/CVSS:3.0/AV:N/A |e,cvss3=5.0/CVSS:3.0/AV:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |:L,cwe=CWE-79,fedora-all/xm |:L,cwe=CWE-79,fedora-all/xm |lrpc=affected,rhel-5/xmlrpc |lrpc=affected,rhel-5/xmlrpc |=wontfix,rhel-6/xmlrpc3=won |=wontfix,rhel-6/xmlrpc3=won |tfix,rhel-7/xmlrpc=wontfix, |tfix,rhel-7/xmlrpc=wontfix, |rhev-m-3/xmlrpc-common=wont |rhev-m-3/xmlrpc-common=wont |fix,rhscl-3/rh-java-common- |fix,rhscl-3/rh-java-common- |xmlrpc=new,rhes-3/xmlrpc-co |xmlrpc=new,rhes-3/xmlrpc-co |mmon=wontfix,jbds-8/xmlrpc= |mmon=wontfix,jbds-8/xmlrpc= |notaffected,jbds-10/xmlrpc= |notaffected,jbds-10/xmlrpc= |notaffected,fuse-6/camel-xm |notaffected,fuse-6/camel=af |lrpc=new |fected,fuse-7/camel=affecte | |d,fis-2/xmlrpc-common=affec | |ted
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Riccardo Schirone rschiron@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|CVE-2016-5004 xmlrpc: XSS |CVE-2016-5004 xmlrpc: DoS |in Content-Encoding HTTP |through decompression-bomb |header of xmlrpc |attack when | |Content-Encoding=gzip
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Riccardo Schirone rschiron@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160524, |impact=low,public=20160524, |reported=20160524,source=cv |reported=20160524,source=cv |e,cvss3=5.0/CVSS:3.0/AV:N/A |e,cvss3=5.0/CVSS:3.0/AV:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |:L,cwe=CWE-79,fedora-all/xm |:L,cwe=CWE-79,fedora-all/xm |lrpc=affected,rhel-5/xmlrpc |lrpc=affected,rhel-5/xmlrpc |=wontfix,rhel-6/xmlrpc3=won |=wontfix,rhel-6/xmlrpc3=won |tfix,rhel-7/xmlrpc=wontfix, |tfix,rhel-7/xmlrpc=wontfix, |rhev-m-3/xmlrpc-common=wont |rhev-m-3/xmlrpc-common=wont |fix,rhscl-3/rh-java-common- |fix,rhscl-3/rh-java-common- |xmlrpc=new,rhes-3/xmlrpc-co |xmlrpc=affected,rhes-3/xmlr |mmon=wontfix,jbds-8/xmlrpc= |pc-common=wontfix,jbds-8/xm |notaffected,jbds-10/xmlrpc= |lrpc=notaffected,jbds-10/xm |notaffected,fuse-6/camel=af |lrpc=notaffected,fuse-6/cam |fected,fuse-7/camel=affecte |el=affected,fuse-7/camel=af |d,fis-2/xmlrpc-common=affec |fected,fis-2/xmlrpc-common= |ted |affected
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Riccardo Schirone rschiron@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160524, |impact=low,public=20160524, |reported=20160524,source=cv |reported=20160524,source=cv |e,cvss3=5.0/CVSS:3.0/AV:N/A |e,cvss3=5.0/CVSS:3.0/AV:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |:L,cwe=CWE-79,fedora-all/xm |:L,cwe=CWE-79,fedora-all/xm |lrpc=affected,rhel-5/xmlrpc |lrpc=affected,rhel-5/xmlrpc |=wontfix,rhel-6/xmlrpc3=won |=wontfix,rhel-6/xmlrpc3=won |tfix,rhel-7/xmlrpc=wontfix, |tfix,rhel-7/xmlrpc=wontfix, |rhev-m-3/xmlrpc-common=wont |rhev-m-3/xmlrpc-common=wont |fix,rhscl-3/rh-java-common- |fix,rhscl-3/rh-java-common- |xmlrpc=affected,rhes-3/xmlr |xmlrpc=new,rhes-3/xmlrpc-co |pc-common=wontfix,jbds-8/xm |mmon=wontfix,jbds-8/xmlrpc= |lrpc=notaffected,jbds-10/xm |notaffected,jbds-10/xmlrpc= |lrpc=notaffected,fuse-6/cam |notaffected,fuse-6/camel=af |el=affected,fuse-7/camel=af |fected,fuse-7/camel=affecte |fected,fis-2/xmlrpc-common= |d,fis-2/xmlrpc-common=affec |affected |ted
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Riccardo Schirone rschiron@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=low,public=20160524, |impact=low,public=20160524, |reported=20160524,source=cv |reported=20160524,source=cv |e,cvss3=5.0/CVSS:3.0/AV:N/A |e,cvss3=5.0/CVSS:3.0/AV:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |C:L/PR:L/UI:N/S:C/C:N/I:N/A |:L,cwe=CWE-79,fedora-all/xm |:L,cwe=CWE-409,fedora-all/x |lrpc=affected,rhel-5/xmlrpc |mlrpc=affected,rhel-5/xmlrp |=wontfix,rhel-6/xmlrpc3=won |c=wontfix,rhel-6/xmlrpc3=wo |tfix,rhel-7/xmlrpc=wontfix, |ntfix,rhel-7/xmlrpc=wontfix |rhev-m-3/xmlrpc-common=wont |,rhev-m-3/xmlrpc-common=won |fix,rhscl-3/rh-java-common- |tfix,rhscl-3/rh-java-common |xmlrpc=new,rhes-3/xmlrpc-co |-xmlrpc=affected,rhes-3/xml |mmon=wontfix,jbds-8/xmlrpc= |rpc-common=wontfix,jbds-8/x |notaffected,jbds-10/xmlrpc= |mlrpc=notaffected,jbds-10/x |notaffected,fuse-6/camel=af |mlrpc=notaffected,fuse-6/ca |fected,fuse-7/camel=affecte |mel=affected,fuse-7/camel=a |d,fis-2/xmlrpc-common=affec |ffected,fis-2/xmlrpc-common |ted |=affected
https://bugzilla.redhat.com/show_bug.cgi?id=1508129
Riccardo Schirone rschiron@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1577779
java-sig-commits@lists.fedoraproject.org