java-sig-commits September 2017

java-sig-commits@lists.fedoraproject.org

1 participants
290 discussions

[Bug 1446114] New: CVE-2017-1000353 jenkins: Unauthenticated remote code execution (SECURITY-429)
by bugzilla＠redhat.com 21 Mar '18

21 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1446114 Bug ID: 1446114 Summary: CVE-2017-1000353 jenkins: Unauthenticated remote code execution (SECURITY-429) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, tdawson(a)redhat.com, tiwillia(a)redhat.com An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blacklist-based protection mechanism. SignedObject has been added to the remoting blacklist. In Jenkins 2.54, the remoting-based CLI protocol was deprecated and a new, HTTP based protocol introduced as the new default, in addition to the existing SSH-based CLI. This feature has been backported to Jenkins 2.46.2. It is strongly recommended that users upgrading Jenkins disable the remoting-based CLI, and use the one of the other modes (HTTP or SSH) instead. Affected versions: All Jenkins main line releases up to and including 2.56 All Jenkins LTS releases up to and including 2.46.1 Fixed in: Jenkins main line users should update to 2.57 Jenkins LTS users should update to 2.46.2 External Reference: https://jenkins.io/security/advisory/2017-04-26/ -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1321205] New: tomcat-8.5.0 is available
by Red Hat Bugzilla 19 Mar '18

19 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1321205 Bug ID: 1321205 Summary: tomcat-8.5.0 is available Product: Fedora Version: rawhide Component: tomcat Keywords: FutureFeature, Triaged Assignee: ivan.afonichev(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com, me(a)coolsvap.net Latest upstream release: 8.5.0 Current version/release in rawhide: 8.0.32-4.fc25 URL: http://tomcat.apache.org/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/4987/ -- You are receiving this mail because: You are on the CC list for the bug.

2 55

[Bug 1462416] New: maven-shared-utils-3.2.0 is available
by bugzilla＠redhat.com 15 Mar '18

15 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1462416 Bug ID: 1462416 Summary: maven-shared-utils-3.2.0 is available Product: Fedora Version: rawhide Component: maven-shared-utils Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Latest upstream release: 3.2.0 Current version/release in rawhide: 3.1.0-4.fc26 URL: http://repo1.maven.org/maven2/org/apache/maven/shared/maven-shared-utils/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1940/ -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1493220] New: CVE-2017-12615 tomcat: Remote Code Execution via JSP Upload
by bugzilla＠redhat.com 07 Mar '18

07 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1493220 Bug ID: 1493220 Summary: CVE-2017-12615 tomcat: Remote Code Execution via JSP Upload Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: akurtako(a)redhat.com, alee(a)redhat.com, apintea(a)redhat.com, bkundal(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dimitris(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, felias(a)redhat.com, fgavrilo(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hhorak(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, jolee(a)redhat.com, jondruse(a)redhat.com, jorton(a)redhat.com, jshepherd(a)redhat.com, krzysztof.daniel(a)gmail.com, lgao(a)redhat.com, loleary(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net, mizdebsk(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, pjurak(a)redhat.com, ppalaga(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, rnetuka(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, spinder(a)redhat.com, sstavrev(a)redhat.com, theute(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. Affected versions: 7.0.0 to 7.0.79 External References: https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81 -- You are receiving this mail because: You are on the CC list for the bug.

1 38

[Bug 1340302] New: owasp-java-html-sanitizer-20160526.1 is available
by Red Hat Bugzilla 21 Feb '18

21 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1340302 Bug ID: 1340302 Summary: owasp-java-html-sanitizer-20160526.1 is available Product: Fedora Version: rawhide Component: owasp-java-html-sanitizer Keywords: FutureFeature, Triaged Assignee: msrb(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Latest upstream release: 20160526.1 Current version/release in rawhide: 20160422.1-1.fc25 URL: https://github.com/OWASP/java-html-sanitizer Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/2579/ -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1455566] New: CVE-2014-9970 jasypt: Vulnerable to timing attack against the password hash comparison
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1455566 Bug ID: 1455566 Summary: CVE-2014-9970 jasypt: Vulnerable to timing attack against the password hash comparison Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, alazarot(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, bmcclain(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dblechte(a)redhat.com, dosoudil(a)redhat.com, eedri(a)redhat.com, etirelli(a)redhat.com, gvarsami(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jcoleman(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lpetrovi(a)redhat.com, mbaluch(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mwinkler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rnetuka(a)redhat.com, rrajasek(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, rzhang(a)redhat.com, sherold(a)redhat.com, tcunning(a)redhat.com, tiwillia(a)redhat.com, tkirby(a)redhat.com, twalsh(a)redhat.com, vtunka(a)redhat.com, ydary(a)redhat.com, ykaul(a)redhat.com It was found that jasypt before allows a timing attack against the password hash comparison. Upstream patch: https://sourceforge.net/p/jasypt/code/668/ -- You are receiving this mail because: You are on the CC list for the bug.

1 22

[Bug 1480618] New: CVE-2017-7674 tomcat: Cache Poisoning
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1480618 Bug ID: 1480618 Summary: CVE-2017-7674 tomcat: Cache Poisoning Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: aileenc(a)redhat.com, alee(a)redhat.com, apintea(a)redhat.com, bkundal(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dimitris(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, felias(a)redhat.com, fgavrilo(a)redhat.com, gvarsami(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hhorak(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, jolee(a)redhat.com, jondruse(a)redhat.com, jorton(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, krzysztof.daniel(a)gmail.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, loleary(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net, mizdebsk(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, pjurak(a)redhat.com, ppalaga(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, rnetuka(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, spinder(a)redhat.com, sstavrev(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tkirby(a)redhat.com, trick(a)vanstaveren.us, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com The CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. Affected versions: 7.0.41 to 7.0.78, 8.0.0.RC1 to 8.0.44, 8.5.0 to 8.5.15 Upstream patches: Tomcat 7: https://svn.apache.org/viewvc?view=revision&revision=1795816 Tomcat 8.0.x: https://svn.apache.org/viewvc?view=revision&revision=1795815 Tomcat 8.5.x: https://svn.apache.org/viewvc?view=revision&revision=1795814 External References: https://tomcat.apache.org/security-7.html https://tomcat.apache.org/security-8.html -- You are receiving this mail because: You are on the CC list for the bug.

1 25

[Bug 1454808] New: CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four letter words
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1454808 Bug ID: 1454808 Summary: CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four letter words Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, alazarot(a)redhat.com, chazlett(a)redhat.com, ctubbsii(a)fedoraproject.org, ethan(a)ethantuttle.com, etirelli(a)redhat.com, felias(a)redhat.com, hchiorea(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jolee(a)redhat.com, kseifried(a)redhat.com, kverlaen(a)redhat.com, lpetrovi(a)redhat.com, mbaluch(a)redhat.com, mluscon(a)gmail.com, mwinkler(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, rrajasek(a)redhat.com, rzhang(a)redhat.com, s(a)shk.io, tiwillia(a)redhat.com, tkirby(a)redhat.com, tstclair(a)heptio.com, vhalbert(a)redhat.com Two four letter word commands “wchp/wchc” are CPU intensive and could cause spike of CPU utilization on ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Upstream issue: https://issues.apache.org/jira/browse/ZOOKEEPER-2693 References: https://vulners.com/exploitdb/EDB-ID:41277 -- You are receiving this mail because: You are on the CC list for the bug.

1 20

[Bug 1441223] New: CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1441223 Bug ID: 1441223 Summary: CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: alee(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, felias(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hhorak(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, joelsmith(a)redhat.com, jolee(a)redhat.com, jorton(a)redhat.com, jshepherd(a)redhat.com, krzysztof.daniel(a)gmail.com, lgao(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net, mizdebsk(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, psotirop(a)redhat.com, rnetuka(a)redhat.com, rsvoboda(a)redhat.com, spinder(a)redhat.com, theute(a)redhat.com, trick(a)vanstaveren.us, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com While investigating bug 60718, it was noticed that some calls to application listeners did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application. Upstream fixes: Tomcat 7.x: https://svn.apache.org/viewvc?view=revision&revision=1785777 Tomcat 8.0.x: https://svn.apache.org/viewvc?view=revision&revision=1785776 Tomcat 8.5.x: https://svn.apache.org/viewvc?view=revision&revision=1785775 References: https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.76 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.42 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.12 -- You are receiving this mail because: You are on the CC list for the bug.

1 28

[Bug 1441205] New: CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1441205 Bug ID: 1441205 Summary: CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: aileenc(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, etirelli(a)redhat.com, felias(a)redhat.com, gvarsami(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hhorak(a)redhat.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, joelsmith(a)redhat.com, jolee(a)redhat.com, jorton(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lpetrovi(a)redhat.com, mbabacek(a)redhat.com, mbaluch(a)redhat.com, me(a)coolsvap.net, mizdebsk(a)redhat.com, mwinkler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, psotirop(a)redhat.com, rnetuka(a)redhat.com, rrajasek(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, rzhang(a)redhat.com, spinder(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tkirby(a)redhat.com, trick(a)vanstaveren.us, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. Affected versions: 6.0.0 to 6.0.52, 7.0.0 to 7.0.76, 8.0.0.RC1 to 8.0.42 Fixed in revisions: Tomcat 6: https://svn.apache.org/viewvc?view=revision&revision=1789024 https://svn.apache.org/viewvc?view=revision&revision=1789155 https://svn.apache.org/viewvc?view=revision&revision=1789856 Tomcat 7: https://svn.apache.org/viewvc?view=revision&revision=1789008 Tomcat 8: https://svn.apache.org/viewvc?view=revision&revision=1788999 References: https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.53 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.77 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.43 -- You are receiving this mail because: You are on the CC list for the bug.

1 45

← Newer
1
...
12
13
14
15
16
17
18
...
29
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits September 2017