java-sig-commits April 2020

java-sig-commits@lists.fedoraproject.org

1 participants
402 discussions

[Bug 1821311] New: CVE-2020-11112 jackson-databind: jackson-databind: mishandles the interaction between serialization gadgets and typing related to org.apache.commons.proxy.provider.remoting.RmiProvider which could result in remote command execution
by bugzilla＠redhat.com 17 Dec '20

17 Dec '20

https://bugzilla.redhat.com/show_bug.cgi?id=1821311 Bug ID: 1821311 Summary: CVE-2020-11112 jackson-databind: jackson-databind: mishandles the interaction between serialization gadgets and typing related to org.apache.commons.proxy.provider.remoting.RmiProvider which could result in remote command execution Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mkaplan(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, aos-bugs(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dbecker(a)redhat.com, decathorpe(a)gmail.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcantril(a)redhat.com, jjoyce(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschatte(a)redhat.com, jschluet(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kbasil(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mburns(a)redhat.com, mkolesni(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nmoumoul(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rchan(a)redhat.com, rguimara(a)redhat.com, rhcs-maint(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sclewis(a)redhat.com, scohen(a)redhat.com, sdaley(a)redhat.com, slinaber(a)redhat.com, smaestri(a)redhat.com, sokeeffe(a)redhat.com, sponnaga(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org, sthorger(a)redhat.com, swoodman(a)redhat.com, tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com Target Milestone: --- Classification: Other A vulnerability was found in Jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy). -- You are receiving this mail because: You are on the CC list for the bug.

1 39

[Bug 1819208] New: CVE-2020-10968 jackson-databind: serialization gadgets in bus-proxy
by bugzilla＠redhat.com 17 Dec '20

17 Dec '20

https://bugzilla.redhat.com/show_bug.cgi?id=1819208 Bug ID: 1819208 Summary: CVE-2020-10968 jackson-databind: serialization gadgets in bus-proxy Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, aos-bugs(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cbyrne(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, cmacedo(a)redhat.com, darran.lofthouse(a)redhat.com, dbecker(a)redhat.com, decathorpe(a)gmail.com, dffrench(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, drusso(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, hhorak(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcantril(a)redhat.com, jjoyce(a)redhat.com, jmadigan(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschluet(a)redhat.com, jshepherd(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kbasil(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mburns(a)redhat.com, mkolesni(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, ngough(a)redhat.com, nmoumoul(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, pwright(a)redhat.com, rchan(a)redhat.com, rguimara(a)redhat.com, rhcs-maint(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sclewis(a)redhat.com, scohen(a)redhat.com, sdaley(a)redhat.com, slinaber(a)redhat.com, smaestri(a)redhat.com, sokeeffe(a)redhat.com, sponnaga(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org, sthorger(a)redhat.com, swoodman(a)redhat.com, tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com, trepel(a)redhat.com Target Milestone: --- Classification: Other FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy). Reference: https://github.com/FasterXML/jackson-databind/issues/2662 -- You are receiving this mail because: You are on the CC list for the bug.

1 40

[Bug 1702439] New: CVE-2019-0223 qpid-proton: TLS Man in the Middle Vulnerability
by bugzilla＠redhat.com 17 Dec '20

17 Dec '20

https://bugzilla.redhat.com/show_bug.cgi?id=1702439 Bug ID: 1702439 Summary: CVE-2019-0223 qpid-proton: TLS Man in the Middle Vulnerability Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=important,public=20190423,reported=20190423,sou rce=oss-security,cvss3=7.4/CVSS:3.0/AV:N/AC:H/PR:N/UI: N/S:U/C:H/I:H/A:N,cwe=CWE-295->CWE-300,fedora-all/qpid -proton-java=notaffected,amq-6/proton-j=new,fuse-6/pro ton-j=new,fuse-7/proton-j=new,vertx-3/proton-j=new,amq -7/qpid-proton=new,fedora-all/qpid-proton=notaffected, rhn_satellite_6/qpid-proton=new,cfme-5/qpid-proton=new ,openstack-7/qpid-proton=new,openstack-8/qpid-proton=n ew,openstack-14/qpid-proton=new,openstack-14-optools/q pid-proton=new,openstack-rdo/qpid-proton=affected,mrg- m-3/qpid-proton=new,rhui-3/qpid-proton=new,rhev-m-4/qp id-proton=new,amq-7/proton-j=new,mrg-m-3/qpid-proton-j ava=new Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: lpardo(a)redhat.com CC: aileenc(a)redhat.com, apevec(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bmcclain(a)redhat.com, btotty(a)redhat.com, chazlett(a)redhat.com, dajohnso(a)redhat.com, dbecker(a)redhat.com, dblechte(a)redhat.com, dfediuck(a)redhat.com, dmetzger(a)redhat.com, eedri(a)redhat.com, esammons(a)redhat.com, gblomqui(a)redhat.com, gmccullo(a)redhat.com, gtanzill(a)redhat.com, hhudgeon(a)redhat.com, iboverma(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jfrey(a)redhat.com, jhardy(a)redhat.com, jjoyce(a)redhat.com, jochrist(a)redhat.com, jpallich(a)redhat.com, jprause(a)redhat.com, jross(a)redhat.com, jschluet(a)redhat.com, jshepherd(a)redhat.com, kbasil(a)redhat.com, kdixon(a)redhat.com, kgiusti(a)gmail.com, krathod(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com, mburns(a)redhat.com, mcressma(a)redhat.com, messaging-bugs(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mmccune(a)redhat.com, mszynkie(a)redhat.com, obarenbo(a)redhat.com, pgallagh(a)redhat.com, puntogil(a)libero.it, rchan(a)redhat.com, rhos-maint(a)redhat.com, rjerrido(a)redhat.com, roliveri(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, sbonazzo(a)redhat.com, sclewis(a)redhat.com, sherold(a)redhat.com, simaishi(a)redhat.com, slinaber(a)redhat.com, tjay(a)redhat.com, trogers(a)redhat.com Target Milestone: --- Classification: Other The TLS support in Apache Qpid Proton 0.9 - 0.27.0 when using OpenSSL prior to 1.1.0 can under some circumstances connect as a client to a TLS server that offers anonymous ciphers irrespective of whether the client was configured to verify the server's certificate or certificate against the hostname used to connect. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic. This includes the Qpid Proton C library, and all language binding libraries using it. This attack will not work if client certificate authentication is in use as anonymous ciphers cannot be used in this case. References: https://issues.apache.org/jira/browse/PROTON-2014 https://qpid.apache.org/cves/CVE-2019-0223.html Upstream Patch: https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=97c7733 https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=159fac1 https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=4aea0fd https://gitbox.apache.org/repos/asf?p=qpid-proton.git;h=2d3ba8a -- You are receiving this mail because: You are on the CC list for the bug.

1 67

[Bug 1822759] New: CVE-2020-1950 tika: excessive memory usage in PSDParser
by bugzilla＠redhat.com 16 Dec '20

16 Dec '20

https://bugzilla.redhat.com/show_bug.cgi?id=1822759 Bug ID: 1822759 Summary: CVE-2020-1950 tika: excessive memory usage in PSDParser Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, bkearney(a)redhat.com, chazlett(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jochrist(a)redhat.com, jolee(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lef(a)fedoraproject.org, mnovotny(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pjindal(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sdaley(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, vhalbert(a)redhat.com Target Milestone: --- Classification: Other A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. Reference: https://lists.apache.org/thread.html/r463b1a67817ae55fe022536edd6db34e8f963… -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1703402] New: CVE-2019-2692 mysql-connector-java: privilege escalation in MySQL connector
by bugzilla＠redhat.com 16 Dec '20

16 Dec '20

https://bugzilla.redhat.com/show_bug.cgi?id=1703402 Bug ID: 1703402 Summary: CVE-2019-2692 mysql-connector-java: privilege escalation in MySQL connector Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190423,reported=20190424,sour ce=cve,cvss3=6.3/CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/ I:H/A:H,cwe=CWE-843,fedora-all/mysql-connector-java=no taffected,openshift-enterprise-3/mysql-connector-java= new,fsw-6/mysql-connector-java=new,fuse-7/mysql-connec tor-java=new,rhel-6/mysql-connector-java=new,rhel-7/my sql-connector-java=new,rhn_satellite_6/mysql-connector -java=new Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: ahardin(a)redhat.com, aileenc(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bkearney(a)redhat.com, bleanhar(a)redhat.com, btotty(a)redhat.com, ccoleman(a)redhat.com, chazlett(a)redhat.com, databases-maint(a)redhat.com, dedgar(a)redhat.com, eparis(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, hhudgeon(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jgoulding(a)redhat.com, jjanco(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, kconner(a)redhat.com, ldimaggi(a)redhat.com, mchappel(a)redhat.com, mmccune(a)redhat.com, mmuzila(a)redhat.com, mschorm(a)redhat.com, nwallace(a)redhat.com, puntogil(a)libero.it, rchan(a)redhat.com, rjerrido(a)redhat.com, rwagner(a)redhat.com, steve.traylen(a)cern.ch, tcunning(a)redhat.com, tkirby(a)redhat.com, xjakub(a)fi.muni.cz Target Milestone: --- Classification: Other Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. Reference: http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1801380] New: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation
by bugzilla＠redhat.com 16 Dec '20

16 Dec '20

https://bugzilla.redhat.com/show_bug.cgi?id=1801380 Bug ID: 1801380 Summary: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jochrist(a)redhat.com, jperkins(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sdaley(a)redhat.com, smaestri(a)redhat.com, sthorger(a)redhat.com, tom.jenkinson(a)redhat.com Target Milestone: --- Classification: Other CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data. Reference: https://github.com/vt-middleware/cryptacular/issues/52 -- You are receiving this mail because: You are on the CC list for the bug.

1 27

[Bug 1758992] New: CVE-2019-16370 gradle: PGP signing plugin security bypass
by bugzilla＠redhat.com 30 Nov '20

30 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1758992 Bug ID: 1758992 Summary: CVE-2019-16370 gradle: PGP signing plugin security bypass Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: csutherl(a)redhat.com, dan(a)danieljamesscott.org, decathorpe(a)gmail.com, gzaronik(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jclere(a)redhat.com, jjelen(a)redhat.com, lgao(a)redhat.com, lkundrak(a)v3.sk, mbabacek(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, myarboro(a)redhat.com, twalsh(a)redhat.com, weli(a)redhat.com Target Milestone: --- Classification: Other The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900. Reference: https://github.com/gradle/gradle/commit/425b2b7a50cd84106a77cdf1ab665c89c6b… https://github.com/gradle/gradle/pull/10543 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1758994] New: CVE-2019-16370 gradle: PGP signing plugin security bypass [epel-6]
by bugzilla＠redhat.com 30 Nov '20

30 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1758994 Bug ID: 1758994 Summary: CVE-2019-16370 gradle: PGP signing plugin security bypass [epel-6] Product: Fedora EPEL Version: el6 Status: NEW Component: gradle Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: mizdebsk(a)redhat.com Reporter: darunesh(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dan(a)danieljamesscott.org, java-sig-commits(a)lists.fedoraproject.org, lkundrak(a)v3.sk, mizdebsk(a)redhat.com, msimacek(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-6. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1756388] New: CVE-2019-15052 gradle: sends authentication credentials originally destined for the configured host
by bugzilla＠redhat.com 30 Nov '20

30 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1756388 Bug ID: 1756388 Summary: CVE-2019-15052 gradle: sends authentication credentials originally destined for the configured host Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: csutherl(a)redhat.com, dan(a)danieljamesscott.org, decathorpe(a)gmail.com, gzaronik(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jclere(a)redhat.com, jjelen(a)redhat.com, lgao(a)redhat.com, lkundrak(a)v3.sk, mbabacek(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, myarboro(a)redhat.com, twalsh(a)redhat.com, weli(a)redhat.com Target Milestone: --- Classification: Other The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007. References: https://github.com/gradle/gradle/issues/10278 https://github.com/gradle/gradle/pull/10176 https://github.com/gradle/gradle/security/advisories/GHSA-4cwg-f7qc-6r95 -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1756390] New: CVE-2019-15052 gradle: sends authentication credentials originally destined for the configured host [epel-6]
by bugzilla＠redhat.com 30 Nov '20

30 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1756390 Bug ID: 1756390 Summary: CVE-2019-15052 gradle: sends authentication credentials originally destined for the configured host [epel-6] Product: Fedora EPEL Version: el6 Status: NEW Component: gradle Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: mizdebsk(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dan(a)danieljamesscott.org, java-sig-commits(a)lists.fedoraproject.org, lkundrak(a)v3.sk, mizdebsk(a)redhat.com, msimacek(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-6. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

← Newer
1
...
6
7
8
9
10
11
12
...
41
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits April 2020