java-sig-commits March 2021

java-sig-commits@lists.fedoraproject.org

1 participants
272 discussions

[Bug 1693325] New: CVE-2019-0199 tomcat: Apache Tomcat HTTP/2 DoS
by bugzilla＠redhat.com 04 Oct '21

04 Oct '21

https://bugzilla.redhat.com/show_bug.cgi?id=1693325 Bug ID: 1693325 Summary: CVE-2019-0199 tomcat: Apache Tomcat HTTP/2 DoS Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=important,public=20190325,reported=20190326,sou rce=internet,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S: U/C:N/I:N/A:H,cwe=CWE-400,fedora-all/tomcat=affected,r hscl-3/rh-java-common-tomcat=notaffected,bpms-6/tomcat =notaffected,brms-6/tomcat=notaffected,epel-all/tomcat =notaffected,brms-5/jbossweb=notaffected,eap-6/jbosswe b=notaffected,eap-5/jbossweb=notaffected,jdg-6/jbosswe b=notaffected,jdg-7/tomcat=notaffected,jdv-6/jbossweb= notaffected,fuse-6/tomcat=notaffected,fuse-7/tomcat=no taffected,fsw-6/jbossweb=notaffected,soap-5/jbossweb=n otaffected,springboot-1/tomcat=notaffected,jbews-2/tom cat6=notaffected,jws-3/tomcat7=notaffected,rhel-7/tomc at=notaffected,jbews-2/tomcat7=notaffected,jws-3/tomca t8=new,rhel-6/tomcat6=notaffected,jon-3/jbossweb=notaf fected,jws-5/tomcat=new Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: lpardo(a)redhat.com CC: aileenc(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, anstephe(a)redhat.com, apintea(a)redhat.com, avibelli(a)redhat.com, bgeorges(a)redhat.com, bmaxwell(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, cmoulliard(a)redhat.com, coolsvap(a)gmail.com, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dimitris(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, fgavrilo(a)redhat.com, gvarsami(a)redhat.com, gzaronik(a)redhat.com, hhorak(a)redhat.com, ibek(a)redhat.com, ikanello(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdoyle(a)redhat.com, jolee(a)redhat.com, jondruse(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jschatte(a)redhat.com, jshepherd(a)redhat.com, jstastny(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, loleary(a)redhat.com, lpetrovi(a)redhat.com, lthon(a)redhat.com, mbabacek(a)redhat.com, mizdebsk(a)redhat.com, mszynkie(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pgallagh(a)redhat.com, pgier(a)redhat.com, pjurak(a)redhat.com, ppalaga(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, pszubiak(a)redhat.com, rnetuka(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, rzhang(a)redhat.com, sdaley(a)redhat.com, spinder(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tkirby(a)redhat.com, trogers(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com Target Milestone: --- Classification: Other A vulnerability was found in Apache Tomcat version from 9.0.0.M1 to 9.0.14 inclusive and 8.5.0 to 8.5.37 inclusive. The HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. References: https://mail-archives.apache.org/mod_mbox/tomcat-announce/201903.mbox/brows… http://tomcat.apache.org/security-9.html http://tomcat.apache.org/security-8.html -- You are receiving this mail because: You are on the CC list for the bug.

1 21

[Bug 1918544] New: fop-2.6 is available
by bugzilla＠redhat.com 24 Sep '21

24 Sep '21

https://bugzilla.redhat.com/show_bug.cgi?id=1918544 Bug ID: 1918544 Summary: fop-2.6 is available Product: Fedora Version: rawhide Status: NEW Component: fop Keywords: FutureFeature, Triaged Assignee: lemenkov(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, lemenkov(a)gmail.com, mizdebsk(a)redhat.com, rhbugs(a)n-dimensional.de, rlandman(a)redhat.com, tim(a)tim-landscheidt.de Target Milestone: --- Classification: Fedora Latest upstream release: 2.6 Current version/release in rawhide: 2.5-1.fc34 URL: https://xmlgraphics.apache.org/fop/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/829/ -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1785376] New: CVE-2017-18640 snakeyaml: the alias feature entity expansion during a load operation
by bugzilla＠redhat.com 23 Sep '21

23 Sep '21

https://bugzilla.redhat.com/show_bug.cgi?id=1785376 Bug ID: 1785376 Summary: CVE-2017-18640 snakeyaml: the alias feature entity expansion during a load operation Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: decathorpe(a)gmail.com, hhorak(a)redhat.com, jaromir.capik(a)email.cz, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jorton(a)redhat.com, mizdebsk(a)redhat.com, mo(a)morsi.org, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Other The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564. Reference: https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-p… -- You are receiving this mail because: You are on the CC list for the bug.

1 33

[Bug 1880101] New: CVE-2020-13920 activemq: improper authentication allows MITM attack
by bugzilla＠redhat.com 18 Aug '21

18 Aug '21

https://bugzilla.redhat.com/show_bug.cgi?id=1880101 Bug ID: 1880101 Summary: CVE-2020-13920 activemq: improper authentication allows MITM attack Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dblechte(a)redhat.com, dfediuck(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eedri(a)redhat.com, eleandro(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jcoleman(a)redhat.com, jochrist(a)redhat.com, jperkins(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, nwallace(a)redhat.com, pdrozd(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbonazzo(a)redhat.com, sdaley(a)redhat.com, sherold(a)redhat.com, smaestri(a)redhat.com, sthorger(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, yturgema(a)redhat.com Target Milestone: --- Classification: Other Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12. Reference: http://activemq.apache.org/security-advisories.data/CVE-2020-13920-announce… -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1941055] New: CVE-2021-27807 pdfbox: infinite loop while loading crafted PDF file
by bugzilla＠redhat.com 18 Aug '21

18 Aug '21

https://bugzilla.redhat.com/show_bug.cgi?id=1941055 Bug ID: 1941055 Summary: CVE-2021-27807 pdfbox: infinite loop while loading crafted PDF file Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, bibryam(a)redhat.com, chazlett(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, hbraun(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jochrist(a)redhat.com, jolee(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, mnovotny(a)redhat.com, nwallace(a)redhat.com, pantinor(a)redhat.com, pjindal(a)redhat.com, puntogil(a)libero.it, rhel8-maint(a)redhat.com, rrajasek(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sdaley(a)redhat.com, sergio(a)serjux.com, tcunning(a)redhat.com, tkirby(a)redhat.com Target Milestone: --- Classification: Other A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. References: https://www.openwall.com/lists/oss-security/2021/03/19/9 https://lists.apache.org/thread.html/r818058ff1e4b9f6bef4e5a2e74faff38cb3d3… -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1941050] New: CVE-2021-27906 pdfbox: OutOfMemory-Exception while loading a crafted PDF file
by bugzilla＠redhat.com 18 Aug '21

18 Aug '21

https://bugzilla.redhat.com/show_bug.cgi?id=1941050 Bug ID: 1941050 Summary: CVE-2021-27906 pdfbox: OutOfMemory-Exception while loading a crafted PDF file Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, bibryam(a)redhat.com, chazlett(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, hbraun(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jochrist(a)redhat.com, jolee(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, mnovotny(a)redhat.com, nwallace(a)redhat.com, pantinor(a)redhat.com, pjindal(a)redhat.com, puntogil(a)libero.it, rhel8-maint(a)redhat.com, rrajasek(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sdaley(a)redhat.com, sergio(a)serjux.com, tcunning(a)redhat.com, tkirby(a)redhat.com Target Milestone: --- Classification: Other A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions. References: https://www.openwall.com/lists/oss-security/2021/03/19/9 https://lists.apache.org/thread.html/rf35026148ccc0e1af133501c0d003d052883f… -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1907108] New: xstream-1.4.15 is available
by bugzilla＠redhat.com 18 Aug '21

18 Aug '21

https://bugzilla.redhat.com/show_bug.cgi?id=1907108 Bug ID: 1907108 Summary: xstream-1.4.15 is available Product: Fedora Version: rawhide Status: NEW Component: xstream Keywords: FutureFeature, Triaged Assignee: dchen(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dchen(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, lkundrak(a)v3.sk, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 1.4.15 Current version/release in rawhide: 1.4.14-1.fc34 URL: http://x-stream.github.io/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/5270/ -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1891132] New: CVE-2020-27216 jetty: local temporary directory hijacking vulnerability
by bugzilla＠redhat.com 17 Aug '21

17 Aug '21

https://bugzilla.redhat.com/show_bug.cgi?id=1891132 Bug ID: 1891132 Summary: CVE-2020-27216 jetty: local temporary directory hijacking vulnerability Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: abenaiss(a)redhat.com, aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, aos-bugs(a)redhat.com, ataylor(a)redhat.com, bmontgom(a)redhat.com, chazlett(a)redhat.com, drieden(a)redhat.com, eclipse-sig(a)lists.fedoraproject.org, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jcoleman(a)redhat.com, jjohnstn(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, mnovotny(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, pbhattac(a)redhat.com, pdrozd(a)redhat.com, pjindal(a)redhat.com, rrajasek(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sdaley(a)redhat.com, sochotni(a)redhat.com, sponnaga(a)redhat.com, sthorger(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, vbobade(a)redhat.com Target Milestone: --- Classification: Other In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability. References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=567921 https://github.com/eclipse/jetty.project/security/advisories/GHSA-g3wg-6mcf… -- You are receiving this mail because: You are on the CC list for the bug.

1 29

[Bug 1903727] New: CVE-2020-17510 shiro: specially crafted HTTP request may cause an authentication bypass
by bugzilla＠redhat.com 11 Aug '21

11 Aug '21

https://bugzilla.redhat.com/show_bug.cgi?id=1903727 Bug ID: 1903727 Summary: CVE-2020-17510 shiro: specially crafted HTTP request may cause an authentication bypass Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: aileenc(a)redhat.com, ataylor(a)redhat.com, bibryam(a)redhat.com, chazlett(a)redhat.com, dbecker(a)redhat.com, drieden(a)redhat.com, extras-orphan(a)fedoraproject.org, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, hbraun(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jjoyce(a)redhat.com, jochrist(a)redhat.com, jschluet(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, ldimaggi(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, mburns(a)redhat.com, mkolesni(a)redhat.com, nwallace(a)redhat.com, pantinor(a)redhat.com, puntogil(a)libero.it, rwagner(a)redhat.com, sclewis(a)redhat.com, scohen(a)redhat.com, slinaber(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com Target Milestone: --- Classification: Other Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. References: https://lists.apache.org/thread.html/r95bdf3703858b5f958b5e190d747421771b43… https://lists.apache.org/thread.html/rc2cff2538b683d480426393eecf1ce8dd80e0… -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1887257] New: CVE-2020-26945 mybatis: mishandles deserialization of object streams which could result in remote code execution
by bugzilla＠redhat.com 11 Aug '21

11 Aug '21

https://bugzilla.redhat.com/show_bug.cgi?id=1887257 Bug ID: 1887257 Summary: CVE-2020-26945 mybatis: mishandles deserialization of object streams which could result in remote code execution Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mkaplan(a)redhat.com CC: aileenc(a)redhat.com, bibryam(a)redhat.com, chazlett(a)redhat.com, drieden(a)redhat.com, extras-orphan(a)fedoraproject.org, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, hbraun(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jochrist(a)redhat.com, jwon(a)redhat.com, pantinor(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Other MyBatis before 3.5.6 mishandles deserialization of object streams. References: https://github.com/mybatis/mybatis-3/compare/mybatis-3.5.5...mybatis-3.5.6 https://github.com/mybatis/mybatis-3/pull/2079 -- You are receiving this mail because: You are on the CC list for the bug.

1 9

← Newer
1
...
12
13
14
15
16
17
18
...
28
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits March 2021