Epel-packagers-sig July 2022

epel-packagers-sig@lists.stg.fedoraproject.org

1 participants
183 discussions

[Bug 2102001] CVE-2022-33987 got: missing verification of requested URLs allows redirects to UNIX sockets
by bugzilla＠redhat.com 30 Jun '22

30 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102001 --- Comment #4 from Anten Skrabec <askrabec(a)redhat.com> --- Created dotnet6.0 tracking bugs for this issue: Affects: fedora-all [bug 2102911] Created golang-ariga-atlas tracking bugs for this issue: Affects: fedora-all [bug 2102912] Created golang-entgo-ent tracking bugs for this issue: Affects: fedora-all [bug 2102913] Created grafana tracking bugs for this issue: Affects: fedora-all [bug 2102914] Created mozjs68 tracking bugs for this issue: Affects: fedora-all [bug 2102915] Created mozjs78 tracking bugs for this issue: Affects: fedora-all [bug 2102916] Created nodejs-nodemon tracking bugs for this issue: Affects: fedora-all [bug 2102917] Created nodejs:12/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2102918] Created nodejs:13/nodejs tracking bugs for this issue: Affects: epel-all [bug 2102908] Created nodejs:14/nodejs tracking bugs for this issue: Affects: fedora-all [bug 2102919] Created npm-name-cli tracking bugs for this issue: Affects: fedora-all [bug 2102920] Created seamonkey tracking bugs for this issue: Affects: epel-all [bug 2102909] Affects: fedora-all [bug 2102921] Created syncthing tracking bugs for this issue: Affects: epel-all [bug 2102910] Created vagrant tracking bugs for this issue: Affects: fedora-all [bug 2102922] Created yarnpkg tracking bugs for this issue: Affects: fedora-all [bug 2102923] Created zuul tracking bugs for this issue: Affects: fedora-all [bug 2102924] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102001

1 0

[Bug 2102001] CVE-2022-33987 got: missing verification of requested URLs allows redirects to UNIX sockets
by bugzilla＠redhat.com 30 Jun '22

30 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102001 Anten Skrabec <askrabec(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2102918, 2102912, 2102919, | |2102920, 2102909, 2102921, | |2102916, 2102917, 2102908, | |2102923, 2102914, 2102924, | |2102910, 2102915, 2102911, | |2102922, 2102913 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2102908 [Bug 2102908] CVE-2022-33987 nodejs:13/nodejs: got: missing verification of requested URLs allows redirects to UNIX sockets [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102909 [Bug 2102909] CVE-2022-33987 seamonkey: got: missing verification of requested URLs allows redirects to UNIX sockets [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102910 [Bug 2102910] CVE-2022-33987 syncthing: got: missing verification of requested URLs allows redirects to UNIX sockets [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102911 [Bug 2102911] CVE-2022-33987 dotnet6.0: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102912 [Bug 2102912] CVE-2022-33987 golang-ariga-atlas: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102913 [Bug 2102913] CVE-2022-33987 golang-entgo-ent: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102914 [Bug 2102914] CVE-2022-33987 grafana: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102915 [Bug 2102915] CVE-2022-33987 mozjs68: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102916 [Bug 2102916] CVE-2022-33987 mozjs78: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102917 [Bug 2102917] CVE-2022-33987 nodejs-nodemon: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102918 [Bug 2102918] CVE-2022-33987 nodejs:12/nodejs: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102919 [Bug 2102919] CVE-2022-33987 nodejs:14/nodejs: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102920 [Bug 2102920] CVE-2022-33987 npm-name-cli: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102921 [Bug 2102921] CVE-2022-33987 seamonkey: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102922 [Bug 2102922] CVE-2022-33987 vagrant: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102923 [Bug 2102923] CVE-2022-33987 yarnpkg: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2102924 [Bug 2102924] CVE-2022-33987 zuul: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102001

1 0

[Bug 2102923] New: CVE-2022-33987 yarnpkg: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all]
by bugzilla＠redhat.com 30 Jun '22

30 Jun '22

https://bugzilla.redhat.com/show_bug.cgi?id=2102923 Bug ID: 2102923 Summary: CVE-2022-33987 yarnpkg: got: missing verification of requested URLs allows redirects to UNIX sockets [fedora-all] Product: Fedora Version: 36 Status: NEW Component: yarnpkg Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: zsvetlik(a)redhat.com Reporter: askrabec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: epel-packagers-sig(a)lists.fedoraproject.org, ngompa13(a)gmail.com, zsvetlik(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2102923

1 2

Jump to page:

2024

2023

2022

2021

Epel-packagers-sig July 2022