java-sig-commits August 2018

java-sig-commits@lists.stg.fedoraproject.org

1 participants
229 discussions

[Bug 1545900] New: jenkins: Improperly secured form validation for proxy configuration allows Server-Side Request Forgery [fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1545900 Bug ID: 1545900 Summary: jenkins: Improperly secured form validation for proxy configuration allows Server-Side Request Forgery [fedora-all] Product: Fedora Version: 27 Component: jenkins Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: msrb(a)redhat.com Reporter: lpardo(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1545911] New: jenkins: Improper input validation allows unintended access to plugin resource files on case-insensitive file systems [fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1545911 Bug ID: 1545911 Summary: jenkins: Improper input validation allows unintended access to plugin resource files on case-insensitive file systems [fedora-all] Product: Fedora Version: 27 Component: jenkins Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: msrb(a)redhat.com Reporter: lpardo(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1541997] New: CVE-2018-1199 springframework-security: Spring Security : Security bypass with static resources [fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1541997 Bug ID: 1541997 Summary: CVE-2018-1199 springframework-security: Spring Security: Security bypass with static resources [fedora-all] Product: Fedora Version: 27 Component: springframework-security Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: puntogil(a)libero.it Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1540032] New: CVE-2017-8030 springframework-security: spring-framework: Improper URL path validation allows for bypassing of security checks on static resources [fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1540032 Bug ID: 1540032 Summary: CVE-2017-8030 springframework-security: spring-framework: Improper URL path validation allows for bypassing of security checks on static resources [fedora-all] Product: Fedora Version: 27 Component: springframework-security Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: puntogil(a)libero.it Reporter: sfowler(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1553566] New: springframework-security: spring-security: LdapUserDetailsManager.java:changePassword() allows for direct modificiation of user passwords, bypassing the security configuration [fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1553566 Bug ID: 1553566 Summary: springframework-security: spring-security: LdapUserDetailsManager.java:changePassword() allows for direct modificiation of user passwords, bypassing the security configuration [fedora-all] Product: Fedora Version: 27 Component: springframework-security Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: puntogil(a)libero.it Reporter: sfowler(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1549929] New: slf4j-jboss-logmanager: slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution [fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1549929 Bug ID: 1549929 Summary: slf4j-jboss-logmanager: slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution [fedora-all] Product: Fedora Version: 27 Component: slf4j-jboss-logmanager Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: puntogil(a)libero.it Reporter: slong(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, mgoldman(a)redhat.com, puntogil(a)libero.it This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1558840] New: CVE-2017-1000399 jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618) [ fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1558840 Bug ID: 1558840 Summary: CVE-2017-1000399 jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618) [fedora-all] Product: Fedora Version: 27 Component: jenkins Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: msrb(a)redhat.com Reporter: jshepherd(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1558842] New: CVE-2017-1000398 jenkins: "Computer" remote API disclosed information about inaccessible jobs (SECURITY-611) [ fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1558842 Bug ID: 1558842 Summary: CVE-2017-1000398 jenkins: "Computer" remote API disclosed information about inaccessible jobs (SECURITY-611) [fedora-all] Product: Fedora Version: 27 Component: jenkins Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: msrb(a)redhat.com Reporter: jshepherd(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1558848] New: CVE-2017-1000395 jenkins: "User" remote API disclosed users' email addresses (SECURITY-514) [fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1558848 Bug ID: 1558848 Summary: CVE-2017-1000395 jenkins: "User" remote API disclosed users' email addresses (SECURITY-514) [fedora-all] Product: Fedora Version: 27 Component: jenkins Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: msrb(a)redhat.com Reporter: jshepherd(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1558858] New: CVE-2017-1000396 jenkins: Jenkins core bundled vulnerable version of the commons-httpclient library (SECURITY-555) [fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1558858 Bug ID: 1558858 Summary: CVE-2017-1000396 jenkins: Jenkins core bundled vulnerable version of the commons-httpclient library (SECURITY-555) [fedora-all] Product: Fedora Version: 27 Component: jenkins Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: msrb(a)redhat.com Reporter: jshepherd(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

← Newer
1
2
3
4
5
6
7
...
23
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits August 2018