[JBoss JIRA] (SECURITY-753) PicketBox Logger logging does not mask credentials when logging LDAP connection environment
by Stefan Guilhen (JIRA)
[ https://issues.jboss.org/browse/SECURITY-753?page=com.atlassian.jira.plug... ]
Stefan Guilhen closed SECURITY-753.
-----------------------------------
> PicketBox Logger logging does not mask credentials when logging LDAP connection environment
> -------------------------------------------------------------------------------------------
>
> Key: SECURITY-753
> URL: https://issues.jboss.org/browse/SECURITY-753
> Project: PicketBox
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Components: JBossSX
> Affects Versions: PicketBox_4_0_20.Beta1
> Reporter: Stefan Guilhen
> Assignee: Stefan Guilhen
> Fix For: PicketBox_4_0_20.Beta2
>
>
> It was reported that the PicketBoxLogger interface logs the client credentials when TRACE level is set. Although we do not consider this a security flaw in itself, we do recommend that this be considered as a candidate for a security-in-depth fix.
> At the very least, the default implementation should mask the authenticating user's credentials. The bindCredential value is already available in the configuration, however this too can be considered an issue if the configuration files use encrypted passwords.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (DROOLS-306) ReleaseIdImpl should be Serializable
by Adam Baxter (JIRA)
Adam Baxter created DROOLS-306:
----------------------------------
Summary: ReleaseIdImpl should be Serializable
Key: DROOLS-306
URL: https://issues.jboss.org/browse/DROOLS-306
Project: Drools
Issue Type: Bug
Security Level: Public (Everyone can see)
Affects Versions: 6.0.0.CR4
Environment: Fedora 19, JBoss 6.1.1
Reporter: Adam Baxter
Assignee: Mark Proctor
ReleaseIdImpl is not Serializable and will not work if we need to transfer it over the wire.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (SECURITY-753) PicketBox Logger logging does not mask credentials when logging LDAP connection environment
by Stefan Guilhen (JIRA)
Stefan Guilhen created SECURITY-753:
---------------------------------------
Summary: PicketBox Logger logging does not mask credentials when logging LDAP connection environment
Key: SECURITY-753
URL: https://issues.jboss.org/browse/SECURITY-753
Project: PicketBox
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: JBossSX
Affects Versions: PicketBox_4_0_20.Beta1
Reporter: Stefan Guilhen
Assignee: Stefan Guilhen
Fix For: PicketBox_4_0_20.Beta2
It was reported that the PicketBoxLogger interface logs the client credentials when TRACE level is set. Although we do not consider this a security flaw in itself, we do recommend that this be considered as a candidate for a security-in-depth fix.
At the very least, the default implementation should mask the authenticating user's credentials. The bindCredential value is already available in the configuration, however this too can be considered an issue if the configuration files use encrypted passwords.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (DROOLS-305) ReleaseIdImpl implicitly required in KieBuilder implementation
by Adam Baxter (JIRA)
Adam Baxter created DROOLS-305:
----------------------------------
Summary: ReleaseIdImpl implicitly required in KieBuilder implementation
Key: DROOLS-305
URL: https://issues.jboss.org/browse/DROOLS-305
Project: Drools
Issue Type: Bug
Security Level: Public (Everyone can see)
Affects Versions: 6.0.0.CR4
Environment: Fedora 19, JBoss EAP 6.1.1
Reporter: Adam Baxter
Assignee: Mark Proctor
Drools implicitly requires ReleaseIdImpl in its implementation for loading a kjar. Any classes implementing ReleaseId will cause ClassCastExceptions during load:
Caused by: java.lang.ClassCastException: org.jbpm.ee.support.KieReleaseId cannot be cast to org.drools.compiler.kproject.ReleaseIdImpl
at org.drools.compiler.kie.builder.impl.KieBuilderImpl.getCompilationCachePath(KieBuilderImpl.java:289) [drools-compiler-6.0.0.CR4.jar:6.0.0.CR4]
at org.drools.compiler.kie.builder.impl.AbstractKieModule.getCompilationCache(AbstractKieModule.java:300) [drools-compiler-6.0.0.CR4.jar:6.0.0.CR4]
at org.drools.compiler.kie.builder.impl.AbstractKieModule.buildKnowledgePackages(AbstractKieModule.java:164) [drools-compiler-6.0.0.CR4.jar:6.0.0.CR4]
at org.drools.compiler.kie.builder.impl.AbstractKieProject.verify(AbstractKieProject.java:39) [drools-compiler-6.0.0.CR4.jar:6.0.0.CR4]
at org.drools.compiler.kie.builder.impl.KieBuilderImpl.buildKieProject(KieBuilderImpl.java:305) [drools-compiler-6.0.0.CR4.jar:6.0.0.CR4]
at org.drools.compiler.kie.builder.impl.KieBuilderImpl.buildKieModule(KieBuilderImpl.java:300) [drools-compiler-6.0.0.CR4.jar:6.0.0.CR4]
at org.kie.scanner.KieRepositoryScannerImpl.build(KieRepositoryScannerImpl.java:164) [kie-ci-6.0.0.CR4.jar:6.0.0.CR4]
at org.kie.scanner.KieRepositoryScannerImpl.buildArtifact(KieRepositoryScannerImpl.java:119) [kie-ci-6.0.0.CR4.jar:6.0.0.CR4]
at org.kie.scanner.KieRepositoryScannerImpl.loadArtifact(KieRepositoryScannerImpl.java:89) [kie-ci-6.0.0.CR4.jar:6.0.0.CR4]
at org.kie.scanner.KieRepositoryScannerImpl.loadArtifact(KieRepositoryScannerImpl.java:82) [kie-ci-6.0.0.CR4.jar:6.0.0.CR4]
at org.drools.compiler.kie.builder.impl.KieRepositoryImpl.loadKieModuleFromMavenRepo(KieRepositoryImpl.java:109) [drools-compiler-6.0.0.CR4.jar:6.0.0.CR4]
at org.drools.compiler.kie.builder.impl.KieRepositoryImpl.getKieModule(KieRepositoryImpl.java:95) [drools-compiler-6.0.0.CR4.jar:6.0.0.CR4]
at org.drools.compiler.kie.builder.impl.KieRepositoryImpl.getKieModule(KieRepositoryImpl.java:76) [drools-compiler-6.0.0.CR4.jar:6.0.0.CR4]
at org.drools.compiler.kie.builder.impl.KieServicesImpl.newKieContainer(KieServicesImpl.java:82) [drools-compiler-6.0.0.CR4.jar:6.0.0.CR4]
at org.jbpm.ee.startup.KnowledgeManagerBean.getKieContainer(KnowledgeManagerBean.java:61) [test-jbpm-services.jar:]
at org.jbpm.ee.startup.KnowledgeManagerBean.getKieBase(KnowledgeManagerBean.java:74) [test-jbpm-services.jar:]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.7.0_25]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) [rt.jar:1.7.0_25]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.7.0_25]
at java.lang.reflect.Method.invoke(Method.java:606) [rt.jar:1.7.0_25]
at org.jboss.as.ee.component.ManagedReferenceMethodInterceptorFactory$ManagedReferenceMethodInterceptor.processInvocation(ManagedReferenceMethodInterceptorFactory.java:72) [jboss-as-ee-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.invocation.WeavedInterceptor.processInvocation(WeavedInterceptor.java:53) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.as.ee.component.interceptors.UserInterceptorFactory$1.processInvocation(UserInterceptorFactory.java:58) [jboss-as-ee-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.invocation.InterceptorContext$Invocation.proceed(InterceptorContext.java:374) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.as.weld.ejb.Jsr299BindingsInterceptor.doMethodInterception(Jsr299BindingsInterceptor.java:129) [jboss-as-weld-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.as.weld.ejb.Jsr299BindingsInterceptor.processInvocation(Jsr299BindingsInterceptor.java:137) [jboss-as-weld-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.as.ee.component.interceptors.UserInterceptorFactory$1.processInvocation(UserInterceptorFactory.java:58) [jboss-as-ee-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.invocation.WeavedInterceptor.processInvocation(WeavedInterceptor.java:53) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.as.ee.component.interceptors.UserInterceptorFactory$1.processInvocation(UserInterceptorFactory.java:58) [jboss-as-ee-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.as.ejb3.component.invocationmetrics.ExecutionTimeInterceptor.processInvocation(ExecutionTimeInterceptor.java:43) [jboss-as-ejb3-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.invocation.InterceptorContext$Invocation.proceed(InterceptorContext.java:374) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.as.ejb3.concurrency.ContainerManagedConcurrencyInterceptor.processInvocation(ContainerManagedConcurrencyInterceptor.java:104) [jboss-as-ejb3-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.as.weld.ejb.EjbRequestScopeActivationInterceptor.processInvocation(EjbRequestScopeActivationInterceptor.java:74) [jboss-as-weld-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.invocation.InitialInterceptor.processInvocation(InitialInterceptor.java:21) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.as.ee.component.interceptors.ComponentDispatcherInterceptor.processInvocation(ComponentDispatcherInterceptor.java:53) [jboss-as-ee-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.as.ejb3.component.singleton.SingletonComponentInstanceAssociationInterceptor.processInvocation(SingletonComponentInstanceAssociationInterceptor.java:52) [jboss-as-ejb3-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288) [jboss-invocation-1.1.2.Final-redhat-1.jar:1.1.2.Final-redhat-1]
at org.jboss.as.ejb3.tx.CMTTxInterceptor.invokeInCallerTx(CMTTxInterceptor.java:226) [jboss-as-ejb3-7.2.1.Final-redhat-10.jar:7.2.1.Final-redhat-10]
... 186 more
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (WFLY-1954) Exceptions when operating on domain mode
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFLY-1954?page=com.atlassian.jira.plugin.... ]
Brian Stansberry resolved WFLY-1954.
------------------------------------
Resolution: Duplicate Issue
I'm going to assume this was the same thing as the issue reported/fixed in WFLY-2273.
> Exceptions when operating on domain mode
> ----------------------------------------
>
> Key: WFLY-1954
> URL: https://issues.jboss.org/browse/WFLY-1954
> Project: WildFly
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Components: Domain Management
> Reporter: Heiko Braun
> Assignee: Brian Stansberry
> Fix For: 8.0.0.CR1
>
>
> When refreshing the topology view form the web console, you'll see a lot of these:
> {noformat}
> [Host Controller] 17:16:58,942 ERROR [org.jboss.as.controller.client] (XNIO-1 task-9) JBAS014781: Step handler org.jboss.as.domain.controller.operations.coordination.DomainFinalResultHandler@5601ac22 for operation composite at address [] failed handling operation rollback -- null
> {noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (WFLY-2348) standalone.bat very slow
by Brian Stansberry (JIRA)
[ https://issues.jboss.org/browse/WFLY-2348?page=com.atlassian.jira.plugin.... ]
Brian Stansberry updated WFLY-2348:
-----------------------------------
Assignee: (was: Brian Stansberry)
> standalone.bat very slow
> ------------------------
>
> Key: WFLY-2348
> URL: https://issues.jboss.org/browse/WFLY-2348
> Project: WildFly
> Issue Type: Enhancement
> Security Level: Public(Everyone can see)
> Components: Scripts
> Affects Versions: 8.0.0.Beta1
> Reporter: Philippe Marschall
>
> With a plain WildFly AS downloaded and executing {code}standalone.bat{code} we see about two to three seconds spent in this loop:
> {code}
> rem Setup directories, note directories with spaces do not work
> set "CONSOLIDATED_OPTS=%JAVA_OPTS% %SERVER_OPTS%"
> :DIRLOOP
> echo(%CONSOLIDATED_OPTS% | findstr /r /c:"^-Djboss.server.base.dir" > nul && (
> for /f "tokens=1,2* delims==" %%a IN ("%CONSOLIDATED_OPTS%") DO (
> for /f %%i IN ("%%b") DO set "JBOSS_BASE_DIR=%%~fi"
> )
> )
> echo(%CONSOLIDATED_OPTS% | findstr /r /c:"^-Djboss.server.config.dir" > nul && (
> for /f "tokens=1,2* delims==" %%a IN ("%CONSOLIDATED_OPTS%") DO (
> for /f %%i IN ("%%b") DO set "JBOSS_CONFIG_DIR=%%~fi"
> )
> )
> echo(%CONSOLIDATED_OPTS% | findstr /r /c:"^-Djboss.server.log.dir" > nul && (
> for /f "tokens=1,2* delims==" %%a IN ("%CONSOLIDATED_OPTS%") DO (
> for /f %%i IN ("%%b") DO set "JBOSS_LOG_DIR=%%~fi"
> )
> )
> for /f "tokens=1* delims= " %%i IN ("%CONSOLIDATED_OPTS%") DO (
> if %%i == "" (
> goto ENDDIRLOOP
> ) else (
> set CONSOLIDATED_OPTS=%%j
> GOTO DIRLOOP
> )
> )
> :ENDDIRLOOP
> {code}
> It does not seem to define any variables by default, simply removing the code noticeably reduces start up time.
> Windows 7, 64 bit, SSD
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (DROOLS-249) Handle conflicts when using @position in declared types
by Mario Fusco (JIRA)
[ https://issues.jboss.org/browse/DROOLS-249?page=com.atlassian.jira.plugin... ]
Mario Fusco reassigned DROOLS-249:
----------------------------------
Assignee: Mario Fusco (was: Mark Proctor)
> Handle conflicts when using @position in declared types
> -------------------------------------------------------
>
> Key: DROOLS-249
> URL: https://issues.jboss.org/browse/DROOLS-249
> Project: Drools
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Affects Versions: 5.5.0.Final, 6.0.0.CR2
> Reporter: Davide Sottara
> Assignee: Mario Fusco
> Priority: Minor
> Fix For: 5.5.1.Final, 6.0.0.Final
>
>
> declare A
> f : int @position(2)
> g : int @position(1)
> end
> declare B extends A
> h : int @position(3)
> i : int @position(2)
> end
> The resulting field order may not be deterministic because of
> - the clashes (2)
> - the missing pos (0)
> this is dangerous when used with positional constraints
> B( $x, $y, $z, $w ; )
> Marked as minor because of the obvious workaround
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months
[JBoss JIRA] (DROOLS-249) Handle conflicts when using @position in declared types
by Mario Fusco (JIRA)
[ https://issues.jboss.org/browse/DROOLS-249?page=com.atlassian.jira.plugin... ]
Mario Fusco resolved DROOLS-249.
--------------------------------
Resolution: Done
> Handle conflicts when using @position in declared types
> -------------------------------------------------------
>
> Key: DROOLS-249
> URL: https://issues.jboss.org/browse/DROOLS-249
> Project: Drools
> Issue Type: Bug
> Security Level: Public(Everyone can see)
> Affects Versions: 5.5.0.Final, 6.0.0.CR2
> Reporter: Davide Sottara
> Assignee: Mario Fusco
> Priority: Minor
> Fix For: 5.5.1.Final, 6.0.0.Final
>
>
> declare A
> f : int @position(2)
> g : int @position(1)
> end
> declare B extends A
> h : int @position(3)
> i : int @position(2)
> end
> The resulting field order may not be deterministic because of
> - the clashes (2)
> - the missing pos (0)
> this is dangerous when used with positional constraints
> B( $x, $y, $z, $w ; )
> Marked as minor because of the obvious workaround
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
12 years, 9 months