java-sig-commits June 2020

java-sig-commits@lists.fedoraproject.org

1 participants
390 discussions

[Bug 1767371] New: elasticsearch dependencies
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1767371 Bug ID: 1767371 Summary: elasticsearch dependencies Product: Fedora Version: 31 Status: NEW Component: elasticsearch Assignee: bazanluis20(a)gmail.com Reporter: mail(a)lukaszposadowski.pl QA Contact: extras-qa(a)fedoraproject.org CC: bazanluis20(a)gmail.com, bobjensen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com, pahan(a)hubbitus.info, zbyszek(a)in.waw.pl Target Milestone: --- Classification: Fedora Description of problem: elascticsearchpackage has unmet dependencies. Version-Release number of selected component (if applicable): elasticsearch.noarch 1.7.1-3.fc24 fedora How reproducible: Steps to Reproduce: 1. dnf install elasticsearch 2. 3. Actual results: dnf install elasticsearch Last metadata expiration check: 2:08:15 ago on Thu Oct 31 08:58:08 2019. Error: Problem: conflicting requests - nothing provides mvn(org.apache.lucene:lucene-analyzers-common:4.10.4) needed by elasticsearch-1.7.1-3.fc24.noarch - nothing provides mvn(org.apache.lucene:lucene-core:4.10.4) needed by elasticsearch-1.7.1-3.fc24.noarch - nothing provides mvn(org.apache.lucene:lucene-highlighter:4.10.4) needed by elasticsearch-1.7.1-3.fc24.noarch - nothing provides mvn(org.apache.lucene:lucene-join:4.10.4) needed by elasticsearch-1.7.1-3.fc24.noarch - nothing provides mvn(org.apache.lucene:lucene-memory:4.10.4) needed by elasticsearch-1.7.1-3.fc24.noarch - nothing provides mvn(org.apache.lucene:lucene-queries:4.10.4) needed by elasticsearch-1.7.1-3.fc24.noarch - nothing provides mvn(org.apache.lucene:lucene-queryparser:4.10.4) needed by elasticsearch-1.7.1-3.fc24.noarch - nothing provides mvn(org.apache.lucene:lucene-sandbox:4) needed by elasticsearch-1.7.1-3.fc24.noarch - nothing provides mvn(org.apache.lucene:lucene-spatial:4.10.4) needed by elasticsearch-1.7.1-3.fc24.noarch - nothing provides mvn(org.apache.lucene:lucene-suggest:4.10.4) needed by elasticsearch-1.7.1-3.fc24.noarch (try to add '--skip-broken' to skip uninstallable packages) Expected results: Additional info: -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1802532] New: CVE-2019-12415 apache-poi: poi: a specially crafted Microsoft Excel document allows attacker to read files from the local filesystem [fedora-all]
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1802532 Bug ID: 1802532 Summary: CVE-2019-12415 apache-poi: poi: a specially crafted Microsoft Excel document allows attacker to read files from the local filesystem [fedora-all] Product: Fedora Version: 31 Status: NEW Component: apache-poi Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: extras-orphan(a)fedoraproject.org Reporter: mrehak(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1800618] New: CVE-2020-5397 springframework: CSRF attack via CORS Preflight Requests with Spring MVC or Spring WebFlux [fedora-all]
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1800618 Bug ID: 1800618 Summary: CVE-2020-5397 springframework: CSRF attack via CORS Preflight Requests with Spring MVC or Spring WebFlux [fedora-all] Product: Fedora Version: 31 Status: NEW Component: springframework Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: extras-orphan(a)fedoraproject.org Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dingyichen(a)gmail.com, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1797068] New: CVE-2020-2105 jenkins: REST APIs vulnerable to clickjacking
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1797068 Bug ID: 1797068 Summary: CVE-2020-2105 jenkins: REST APIs vulnerable to clickjacking Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: abenaiss(a)redhat.com, adam.kaplan(a)redhat.com, aos-bugs(a)redhat.com, bmontgom(a)redhat.com, eparis(a)redhat.com, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jokerman(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, nstielau(a)redhat.com, pbhattac(a)redhat.com, sponnaga(a)redhat.com, vbobade(a)redhat.com, wzheng(a)redhat.com Target Milestone: --- Classification: Other REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks. References: https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1704 http://www.openwall.com/lists/oss-security/2020/01/29/1 -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1797069] New: CVE-2020-2105 jenkins: REST APIs vulnerable to clickjacking [fedora-all]
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1797069 Bug ID: 1797069 Summary: CVE-2020-2105 jenkins: REST APIs vulnerable to clickjacking [fedora-all] Product: Fedora Version: 31 Status: NEW Component: jenkins Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: extras-orphan(a)fedoraproject.org Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1797066] New: CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read [fedora-all]
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1797066 Bug ID: 1797066 Summary: CVE-2020-2104 jenkins: Memory usage graphs accessible to anyone with Overall/Read [fedora-all] Product: Fedora Version: 31 Status: NEW Component: jenkins Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: extras-orphan(a)fedoraproject.org Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1814510] New: CVE-2019-13990 quartz: libquartz: XXE attacks via job description [fedora-all]
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1814510 Bug ID: 1814510 Summary: CVE-2019-13990 quartz: libquartz: XXE attacks via job description [fedora-all] Product: Fedora Version: 31 Status: NEW Component: quartz Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: extras-orphan(a)fedoraproject.org Reporter: dmoppert(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: agrimm(a)gmail.com, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1819198] New: CVE-2020-2161 jenkins: XSS in job configuration pages
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1819198 Bug ID: 1819198 Summary: CVE-2020-2161 jenkins: XSS in job configuration pages Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com, bmontgom(a)redhat.com, eparis(a)redhat.com, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jokerman(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, nstielau(a)redhat.com, pbhattac(a)redhat.com, sponnaga(a)redhat.com, vbobade(a)redhat.com Target Milestone: --- Classification: Other A vulnerability was found in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels. Reference: http://www.openwall.com/lists/oss-security/2020/03/25/2 -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 1819222] New: CVE-2020-2163 jenkins: improperly processes HTML content of list leads to XSS
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1819222 Bug ID: 1819222 Summary: CVE-2020-2163 jenkins: improperly processes HTML content of list leads to XSS Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com, bmontgom(a)redhat.com, eparis(a)redhat.com, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jokerman(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, nstielau(a)redhat.com, pbhattac(a)redhat.com, sponnaga(a)redhat.com, vbobade(a)redhat.com Target Milestone: --- Classification: Other A vulnerability was found in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers. Reference: https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1796 -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 1819223] New: CVE-2020-2163 jenkins: improperly processes HTML content of list leads to XSS [fedora-all]
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1819223 Bug ID: 1819223 Summary: CVE-2020-2163 jenkins: improperly processes HTML content of list leads to XSS [fedora-all] Product: Fedora Version: 31 Status: NEW Component: jenkins Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: extras-orphan(a)fedoraproject.org Reporter: darunesh(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

← Newer
1
...
9
10
11
12
13
14
15
...
39
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits June 2020