java-sig-commits July 2019

java-sig-commits@lists.fedoraproject.org

1 participants
422 discussions

[Bug 1685179] New: CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service
by bugzilla＠redhat.com 27 Nov '19

27 Nov '19

https://bugzilla.redhat.com/show_bug.cgi?id=1685179 Bug ID: 1685179 Summary: CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=important,public=20190301,reported=20190301,sou rce=oss-security,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI: N/S:U/C:N/I:N/A:H,cwe=CWE-20,fedora-all/qpid-java=affe cted,mrg-m-3/qpid-java=notaffected Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: esammons(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jross(a)redhat.com, mcressma(a)redhat.com, messaging-bugs(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com Target Milestone: --- Classification: Other A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Upstream issue: https://issues.apache.org/jira/browse/QPID-8273 References: https://seclists.org/oss-sec/2019/q1/152 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1685180] New: CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service [fedora-all]
by bugzilla＠redhat.com 27 Nov '19

27 Nov '19

https://bugzilla.redhat.com/show_bug.cgi?id=1685180 Bug ID: 1685180 Summary: CVE-2019-0200 qpid-java: Malformed AMQP 0-8 to 0-10 commands resulting in a Denial of Service [fedora-all] Product: Fedora Version: 29 Status: NEW Component: qpid-java Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: puntogil(a)libero.it Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1684557] New: CVE-2019-1003024 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1320) [fedora-all]
by bugzilla＠redhat.com 27 Nov '19

27 Nov '19

https://bugzilla.redhat.com/show_bug.cgi?id=1684557 Bug ID: 1684557 Summary: CVE-2019-1003024 jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1320) [fedora-all] Product: Fedora Version: 29 Status: NEW Component: jenkins-script-security-plugin Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: msrb(a)redhat.com Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1670284] New: jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292) [fedora-all]
by bugzilla＠redhat.com 27 Nov '19

27 Nov '19

https://bugzilla.redhat.com/show_bug.cgi?id=1670284 Bug ID: 1670284 Summary: jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security Plugin (SECURITY-1292) [fedora-all] Product: Fedora Version: 29 Status: NEW Component: jenkins-script-security-plugin Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: msrb(a)redhat.com Reporter: sfowler(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1667570] New: jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security and Pipeline Plugins (SECURITY-1266) [fedora-all]
by bugzilla＠redhat.com 27 Nov '19

27 Nov '19

https://bugzilla.redhat.com/show_bug.cgi?id=1667570 Bug ID: 1667570 Summary: jenkins-script-security-plugin: jenkins-plugin-script-security: Sandbox Bypass in Script Security and Pipeline Plugins (SECURITY-1266) [fedora-all] Product: Fedora Version: 29 Status: NEW Component: jenkins-script-security-plugin Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: msrb(a)redhat.com Reporter: lpardo(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1667571] New: groovy-sandbox: jenkins-plugin-script-security: Sandbox Bypass in Script Security and Pipeline Plugins (SECURITY-1266) [fedora-all]
by bugzilla＠redhat.com 27 Nov '19

27 Nov '19

https://bugzilla.redhat.com/show_bug.cgi?id=1667571 Bug ID: 1667571 Summary: groovy-sandbox: jenkins-plugin-script-security: Sandbox Bypass in Script Security and Pipeline Plugins (SECURITY-1266) [fedora-all] Product: Fedora Version: 29 Status: NEW Component: groovy-sandbox Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: msrb(a)redhat.com Reporter: lpardo(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1668345] New: CVE-2019-1003003 Jenkins: cookie crafted using Jenkins script console allows unauthorised access to Jenkins instance
by bugzilla＠redhat.com 27 Nov '19

27 Nov '19

https://bugzilla.redhat.com/show_bug.cgi?id=1668345 Bug ID: 1668345 Summary: CVE-2019-1003003 Jenkins: cookie crafted using Jenkins script console allows unauthorised access to Jenkins instance Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190116,reported=20190116,sour ce=oss-security,cvss3=6.6/CVSS:3.0/AV:N/AC:H/PR:H/UI:N /S:U/C:H/I:H/A:H,cwe=CWE-384->CWE-613,fedora-28/jenkin s=affected Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: msiddiqu(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Other Users with the Overall/RunScripts permission (typically administrators) were able to use the Jenkins script console to craft a 'Remember me' cookie that would never expire. This allowed attackers access to a Jenkins instance while the corresponding user in the configured security realm exists, for example to persist access after another successful attack. -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1668446] New: CVE-2019-1003003 jenkins: cookie crafted using Jenkins script console allows unauthorised access to Jenkins instance [fedora-all]
by bugzilla＠redhat.com 27 Nov '19

27 Nov '19

https://bugzilla.redhat.com/show_bug.cgi?id=1668446 Bug ID: 1668446 Summary: CVE-2019-1003003 jenkins: cookie crafted using Jenkins script console allows unauthorised access to Jenkins instance [fedora-all] Product: Fedora Version: 29 Status: NEW Component: jenkins Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: msrb(a)redhat.com Reporter: msiddiqu(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1663926] New: CVE-2018-17197 tika: Infinite loop in SQLite3Parser resulting in a denial of service [fedora-all]
by bugzilla＠redhat.com 27 Nov '19

27 Nov '19

https://bugzilla.redhat.com/show_bug.cgi?id=1663926 Bug ID: 1663926 Summary: CVE-2018-17197 tika: Infinite loop in SQLite3Parser resulting in a denial of service [fedora-all] Product: Fedora Version: 29 Status: NEW Component: tika Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: puntogil(a)libero.it Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1700305] New: package hamcrest-1.3-25.fc30.noarch requires hamcrest-core = 1.3-25.fc30, but none of the providers can be installed - hamcrest-1.3-24.fc29.noarch does not belong to a distupgrade repository
by bugzilla＠redhat.com 27 Nov '19

27 Nov '19

https://bugzilla.redhat.com/show_bug.cgi?id=1700305 Bug ID: 1700305 Summary: package hamcrest-1.3-25.fc30.noarch requires hamcrest-core = 1.3-25.fc30, but none of the providers can be installed - hamcrest-1.3-24.fc29.noarch does not belong to a distupgrade repository Product: Fedora Version: 29 Status: NEW Component: hamcrest Assignee: dwalluck(a)redhat.com Reporter: sanjay.ankur(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, dwalluck(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Experiencing this while trying to dnf system-upgrade to F30: sudo dnf system-upgrade download --refresh --releasever=30 --setopt='module_platform_id=platform:f30' stops at: Problem 3: problem with installed package hamcrest-1.3-24.fc29.noarch - package hamcrest-1.3-25.fc30.noarch requires hamcrest-core = 1.3-25.fc30, but none of the providers can be installed - hamcrest-1.3-24.fc29.noarch does not belong to a distupgrade repository - package hamcrest-core-1.3-25.fc30.noarch is excluded Current workaround is to remove the package and then re-run the command. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

← Newer
1
...
11
12
13
14
15
16
17
...
43
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits July 2019