java-sig-commits July 2020

java-sig-commits@lists.fedoraproject.org

1 participants
430 discussions

[Bug 1806835] New: CVE-2020-1935 tomcat: HTTP Request Smuggling
by bugzilla＠redhat.com 11 Aug '21

11 Aug '21

https://bugzilla.redhat.com/show_bug.cgi?id=1806835 Bug ID: 1806835 Summary: CVE-2020-1935 tomcat: HTTP Request Smuggling Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: jwon(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bgeorges(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, cmoulliard(a)redhat.com, coolsvap(a)gmail.com, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dbecker(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, ggaughan(a)redhat.com, gzaronik(a)redhat.com, ibek(a)redhat.com, ikanello(a)redhat.com, ivan.afonichev(a)gmail.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jclere(a)redhat.com, jjoyce(a)redhat.com, jochrist(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschluet(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kbasil(a)redhat.com, krathod(a)redhat.com, krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com, mbabacek(a)redhat.com, mburns(a)redhat.com, mkolesni(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, rguimara(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sclewis(a)redhat.com, scohen(a)redhat.com, sdaley(a)redhat.com, slinaber(a)redhat.com, smaestri(a)redhat.com, tom.jenkinson(a)redhat.com, weli(a)redhat.com Target Milestone: --- Classification: Other The HTTP header parsing code used an approach to end-of-line (EOL) parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely. It affects the version of Apache Tomcat 9 before 9.0.31, Tomcat 8 before 8.5.51, and Tomcat 7 before 7.0.100. Upstream Patches: https://github.com/apache/tomcat/commit/8bfb0ff / tomcat9 https://github.com/apache/tomcat/commit/8fbe2e9 / tomcat8 https://github.com/apache/tomcat/commit/702bf15 / tomcat7 -- You are receiving this mail because: You are on the CC list for the bug.

1 45

[Bug 1805006] New: Mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter, incomplete fix of CVE-2018-14371
by bugzilla＠redhat.com 11 Aug '21

11 Aug '21

https://bugzilla.redhat.com/show_bug.cgi?id=1805006 Bug ID: 1805006 Summary: Mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter, incomplete fix of CVE-2018-14371 Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: jwon(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gvarsami(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jcoleman(a)redhat.com, jochrist(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, loleary(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rchan(a)redhat.com, rguimara(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sdaley(a)redhat.com, smaestri(a)redhat.com, sokeeffe(a)redhat.com, spinder(a)redhat.com, sthorger(a)redhat.com, tbrisker(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, tom.jenkinson(a)redhat.com Blocks: 1783879 Target Milestone: --- Classification: Other A flaw was found in Mojarra. ResourceManager.java:getLocalePrefix() discloses WEB-INF/faces-config.xml via the loc parameter. It was already reported as CVE-2019-0199, but it's incomplete fix. -- You are receiving this mail because: You are on the CC list for the bug.

1 42

[Bug 1798509] New: CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header
by bugzilla＠redhat.com 11 Aug '21

11 Aug '21

https://bugzilla.redhat.com/show_bug.cgi?id=1798509 Bug ID: 1798509 Summary: CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, aos-bugs(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcantril(a)redhat.com, jerboaa(a)gmail.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jross(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lgao(a)redhat.com, loleary(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, rchan(a)redhat.com, rguimara(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sdaley(a)redhat.com, smaestri(a)redhat.com, sochotni(a)redhat.com, sokeeffe(a)redhat.com, spinder(a)redhat.com, sponnaga(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org, sthorger(a)redhat.com, tbrisker(a)redhat.com, theute(a)redhat.com, tom.jenkinson(a)redhat.com Target Milestone: --- Classification: Other A vulnerability was found in HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. Reference: https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Fi… https://github.com/netty/netty/issues/9861 https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919… https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b107913… https://lists.apache.org/thread.html/r640eb9b3213058a963e18291f903fc1584e57… https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd332657… https://lists.apache.org/thread.html/r804895eedd72c9ec67898286eb185e04df852… https://lists.apache.org/thread.html/r81700644754e66ffea465c869cb477de25f80… https://lists.apache.org/thread.html/r96e08f929234e8ba1ef4a93a0fd2870f535a1… https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa841… https://lists.apache.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755ec… https://lists.apache.org/thread.html/ra9fbfe7d4830ae675bf34c7c0f8c22fc8a409… https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d… https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7f… https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22d… https://lists.apache.org/thread.html/rff210a24f3a924829790e69eaefa84820902b… -- You are receiving this mail because: You are on the CC list for the bug.

1 54

[Bug 1800617] New: CVE-2020-5397 springframework: CSRF attack via CORS Preflight Requests with Spring MVC or Spring WebFlux
by bugzilla＠redhat.com 24 Jun '21

24 Jun '21

https://bugzilla.redhat.com/show_bug.cgi?id=1800617 Bug ID: 1800617 Summary: CVE-2020-5397 springframework: CSRF attack via CORS Preflight Requests with Spring MVC or Spring WebFlux Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, chazlett(a)redhat.com, dblechte(a)redhat.com, dfediuck(a)redhat.com, dingyichen(a)gmail.com, drieden(a)redhat.com, eedri(a)redhat.com, esammons(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gvarsami(a)redhat.com, hvyas(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jochrist(a)redhat.com, jolee(a)redhat.com, jross(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lef(a)fedoraproject.org, mcressma(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mnovotny(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pjindal(a)redhat.com, puebele(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbonazzo(a)redhat.com, sdaley(a)redhat.com, sherold(a)redhat.com, sisharma(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, vbellur(a)redhat.com, vhalbert(a)redhat.com, yturgema(a)redhat.com Target Milestone: --- Classification: Other Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack. Reference: https://pivotal.io/security/cve-2020-5397 -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1816216] New: netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
by bugzilla＠redhat.com 23 Jun '21

23 Jun '21

https://bugzilla.redhat.com/show_bug.cgi?id=1816216 Bug ID: 1816216 Summary: netty: compression/decompression codecs don't enforce limits on buffer allocation sizes Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, aos-bugs(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcantril(a)redhat.com, jerboaa(a)gmail.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jross(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lgao(a)redhat.com, loleary(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, rchan(a)redhat.com, rgodfrey(a)redhat.com, rguimara(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sdaley(a)redhat.com, smaestri(a)redhat.com, sochotni(a)redhat.com, sokeeffe(a)redhat.com, spinder(a)redhat.com, sponnaga(a)redhat.com, sthorger(a)redhat.com, swoodman(a)redhat.com, tbrisker(a)redhat.com, theute(a)redhat.com, tom.jenkinson(a)redhat.com Target Milestone: --- Classification: Other A vulnerability was found in Netty in the way it handles the amount of data they compress and decompress. Compression/Decompression Codecs should enforce memory allocation size limits to avoid OOME or exhaust the memory pool. Reference: https://github.com/netty/netty/pull/9924 -- You are receiving this mail because: You are on the CC list for the bug.

1 53

[Bug 1709379] New: CVE-2018-20200 okhttp: certificate pinning bypass
by bugzilla＠redhat.com 16 Jun '21

16 Jun '21

https://bugzilla.redhat.com/show_bug.cgi?id=1709379 Bug ID: 1709379 Summary: CVE-2018-20200 okhttp: certificate pinning bypass Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190419,reported=20190419,sour ce=cve,cvss3=6.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/ I:L/A:N,cwe=CWE-300,fedora-all/okhttp=affected,openshi ft-enterprise-3/okhttp=new,fuse-7/okhttp=new,rhpam-7/o khttp=new,rhdm-7/okhttp=new,springboot-1/okhttp=new Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: msiddiqu(a)redhat.com CC: ahardin(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, avibelli(a)redhat.com, bgeorges(a)redhat.com, bleanhar(a)redhat.com, ccoleman(a)redhat.com, chazlett(a)redhat.com, cmoulliard(a)redhat.com, dedgar(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, gerard(a)ryan.lt, ibek(a)redhat.com, ikanello(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jgoulding(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jpallich(a)redhat.com, jshepherd(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, lpetrovi(a)redhat.com, lthon(a)redhat.com, mchappel(a)redhat.com, mizdebsk(a)redhat.com, mnovotny(a)redhat.com, mszynkie(a)redhat.com, paradhya(a)redhat.com, pgallagh(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rruss(a)redhat.com, rsynek(a)redhat.com, sdaley(a)redhat.com, trogers(a)redhat.com Target Milestone: --- Classification: Other CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. Upstream issue: https://github.com/square/okhttp/issues/4967 References: https://cxsecurity.com/issue/WLB-2018120252 https://github.com/square/okhttp/commits/master https://github.com/square/okhttp/releases https://square.github.io/okhttp/3.x/okhttp/ -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1831905] New: snappy-java-1.1.7.4 is available
by bugzilla＠redhat.com 08 Jun '21

08 Jun '21

https://bugzilla.redhat.com/show_bug.cgi?id=1831905 Bug ID: 1831905 Summary: snappy-java-1.1.7.4 is available Product: Fedora Version: rawhide Status: NEW Component: snappy-java Keywords: FutureFeature, Triaged Assignee: decathorpe(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, puntogil(a)libero.it, ricardo.arguello(a)gmail.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 1.1.7.4 Current version/release in rawhide: 1.1.2.4-14.fc32 URL: https://github.com/xerial/snappy-java Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/10991/ -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1818159] New: janino-3.1.2 is available
by bugzilla＠redhat.com 08 Jun '21

08 Jun '21

https://bugzilla.redhat.com/show_bug.cgi?id=1818159 Bug ID: 1818159 Summary: janino-3.1.2 is available Product: Fedora Version: rawhide Status: NEW Component: janino Keywords: FutureFeature, Triaged Assignee: decathorpe(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, mefoster(a)gmail.com, puntogil(a)libero.it, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 3.1.2 Current version/release in rawhide: 2.7.8-13.fc32 URL: https://janino-compiler.github.io/janino/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/89329/ -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1858946] New: CVE-2020-13932 activemq: remote XSS in web console diagram plugin
by bugzilla＠redhat.com 07 Jun '21

07 Jun '21

https://bugzilla.redhat.com/show_bug.cgi?id=1858946 Bug ID: 1858946 Summary: CVE-2020-13932 activemq: remote XSS in web console diagram plugin Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dblechte(a)redhat.com, dfediuck(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eedri(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jcoleman(a)redhat.com, jochrist(a)redhat.com, jperkins(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbonazzo(a)redhat.com, sdaley(a)redhat.com, sherold(a)redhat.com, smaestri(a)redhat.com, sthorger(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, yturgema(a)redhat.com Target Milestone: --- Classification: Other A specifically crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section. Reference: https://activemq.apache.org/security-advisories.data/CVE-2020-13932-announc… -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1848045] New: CVE-2020-1941 activemq: Cross-site scripting in webconsole admin GUI
by bugzilla＠redhat.com 07 Jun '21

07 Jun '21

https://bugzilla.redhat.com/show_bug.cgi?id=1848045 Bug ID: 1848045 Summary: CVE-2020-1941 activemq: Cross-site scripting in webconsole admin GUI Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aboyko(a)redhat.com, agrimm(a)gmail.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dblechte(a)redhat.com, dfediuck(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eedri(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jcoleman(a)redhat.com, jochrist(a)redhat.com, jperkins(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbonazzo(a)redhat.com, sdaley(a)redhat.com, sherold(a)redhat.com, smaestri(a)redhat.com, s(a)shk.io, sthorger(a)redhat.com, tcunning(a)redhat.com, tdawson(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, yturgema(a)redhat.com Target Milestone: --- Classification: Other In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue. References: http://activemq.apache.org/security-advisories.data/CVE-2020-1941-announcem… -- You are receiving this mail because: You are on the CC list for the bug.

1 7

← Newer
1
...
4
5
6
7
8
9
10
...
43
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits July 2020