https://bugzilla.redhat.com/show_bug.cgi?id=1570970
Bug ID: 1570970
Summary: CVE-2018-5429 jasperreports: arbitrary code execution
in analytic reports that contain scripting
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it,
rhel8-maint(a)redhat.com
A vulnerability in the report scripting component of TIBCO Software Inc.'s
TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO
JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO
JasperReports Library Community Edition, TIBCO JasperReports Library for
ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft
Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft
Studio Community Edition, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may
allow analytic reports that contain scripting to perform arbitrary code
execution. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports
Server: versions up to and including 6.2.4; 6.3.0; 6.3.2;6.3.3; 6.4.0; 6.4.2,
TIBCO JasperReports Server Community Edition: versions up to and including
6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and
including 6.4.2, TIBCO JasperReports Library: versions up to and including
6.2.4; 6.3.0; 6.3.2; 6.3.3; 6.4.0; 6.4.1; 6.4.2, TIBCO JasperReports Library
Community Edition: versions up to and including 6.4.3, TIBCO JasperReports
Library for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO
Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2,
TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including
6.4.2, TIBCO Jaspersoft Studio: versions up to and including 6.2.4; 6.3.0;
6.3.2; 6.3.3; 6.4.0; 6.4.2, TIBCO Jaspersoft Studio Community Edition: versions
up to and including 6.4.3, TIBCO Jaspersoft Studio for ActiveMatrix BPM:
versions up to and including 6.4.2.
References:
https://www.tibco.com/support/advisories/2018/04/tibco-security-advisory-...
--
You are receiving this mail because:
You are on the CC list for the bug.