[JBoss JIRA] (WFCORE-5150) Elytron - PolicyDefinitions#registerHandler uses double-check of the same thing
by Rostislav Svoboda (Jira)
Rostislav Svoboda created WFCORE-5150:
-----------------------------------------
Summary: Elytron - PolicyDefinitions#registerHandler uses double-check of the same thing
Key: WFCORE-5150
URL: https://issues.redhat.com/browse/WFCORE-5150
Project: WildFly Core
Issue Type: Bug
Components: Security
Reporter: Rostislav Svoboda
Assignee: Rostislav Svoboda
Elytron - PolicyDefinitions#registerHandler uses double-check of the same thing
{code:java}
if (discovered != null) {
...
PolicyContext.registerHandler(key, discovered != null ? new DelegatingPolicyContextHandler(key, handler, discovered) : handler, true);
}
{code}
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
5 years, 7 months
[JBoss JIRA] (WFLY-13306) Deployment of empty war with 2.3 faces-config.xml fails
by Wolfgang Knauf (Jira)
[ https://issues.redhat.com/browse/WFLY-13306?page=com.atlassian.jira.plugi... ]
Wolfgang Knauf updated WFLY-13306:
----------------------------------
Affects Version/s: 21.0.0.Beta1
> Deployment of empty war with 2.3 faces-config.xml fails
> -------------------------------------------------------
>
> Key: WFLY-13306
> URL: https://issues.redhat.com/browse/WFLY-13306
> Project: WildFly
> Issue Type: Bug
> Components: JSF
> Affects Versions: 19.0.0.Final, 21.0.0.Beta1
> Reporter: Wolfgang Knauf
> Assignee: Parul Sharma
> Priority: Major
> Attachments: JsfSample.zip
>
>
> Attached sample is created from the archetype "wildfly-jakartaee-webapp-archetype" found at [https://github.com/wildfly/wildfly-archetypes/] (still 18.0, an update for WildFly 19.0 is currently in work). It is an empty project, the only change is that in "faces-config.xml" the version was changed from 2.2 to 2.3.
> Deployment fails with this exception:
> {quote}
> 2020-03-30 20:05:45,200 SEVERE [javax.enterprise.resource.webcontainer.jsf.config] (ServerService Thread Pool -- 83) Critical error during deployment: : com.sun.faces.config.ConfigurationException: CONFIGURATION FAILED! null
> at com.sun.faces.config.ConfigManager.initialize(ConfigManager.java:357)
> at com.sun.faces.config.ConfigureListener.contextInitialized(ConfigureListener.java:205)
> at io.undertow.servlet.core.ApplicationListeners.contextInitialized(ApplicationListeners.java:187)
> at io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:217)
> at io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:186)
> at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
> at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1541)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1541)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1541)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1541)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1541)
> at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:252)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:96)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
> at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
> at java.util.concurrent.FutureTask.run(Unknown Source)
> at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
> at java.lang.Thread.run(Unknown Source)
> at org.jboss.threads.JBossThread.run(JBossThread.java:485)
> Caused by: java.lang.NullPointerException
> at com.sun.faces.facelets.impl.DefaultResourceResolver.resolveUrl(DefaultResourceResolver.java:40)
> at com.sun.faces.facelets.impl.DefaultFaceletFactory.init(DefaultFaceletFactory.java:129)
> at com.sun.faces.application.ApplicationAssociate.createFaceletFactory(ApplicationAssociate.java:849)
> at com.sun.faces.application.ApplicationAssociate.initializeFacelets(ApplicationAssociate.java:342)
> at com.sun.faces.application.ApplicationAssociate.getCompiler(ApplicationAssociate.java:420)
> at com.sun.faces.config.processor.FaceletTaglibConfigProcessor.process(FaceletTaglibConfigProcessor.java:217)
> at com.sun.faces.config.ConfigManager.initialize(ConfigManager.java:341)
> ... 23 more
> 2020-03-30 20:05:45,207 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 83) MSC000001: Failed to start service jboss.deployment.unit."JsfSample.war".undertow-deployment: org.jboss.msc.service.StartException in service jboss.deployment.unit."JsfSample.war".undertow-deployment: java.lang.RuntimeException: java.lang.RuntimeException: com.sun.faces.config.ConfigurationException: CONFIGURATION FAILED! null
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
> at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
> at java.util.concurrent.FutureTask.run(Unknown Source)
> at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
> at java.lang.Thread.run(Unknown Source)
> at org.jboss.threads.JBossThread.run(JBossThread.java:485)
> Caused by: java.lang.RuntimeException: java.lang.RuntimeException: com.sun.faces.config.ConfigurationException: CONFIGURATION FAILED! null
> at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:254)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:96)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
> ... 8 more
> Caused by: java.lang.RuntimeException: com.sun.faces.config.ConfigurationException: CONFIGURATION FAILED! null
> at com.sun.faces.config.ConfigureListener.contextInitialized(ConfigureListener.java:283)
> at io.undertow.servlet.core.ApplicationListeners.contextInitialized(ApplicationListeners.java:187)
> at io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:217)
> at io.undertow.servlet.core.DeploymentManagerImpl$1.call(DeploymentManagerImpl.java:186)
> at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
> at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1541)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1541)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1541)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1541)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1541)
> at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:252)
> ... 10 more
> Caused by: com.sun.faces.config.ConfigurationException: CONFIGURATION FAILED! null
> at com.sun.faces.config.ConfigManager.initialize(ConfigManager.java:357)
> at com.sun.faces.config.ConfigureListener.contextInitialized(ConfigureListener.java:205)
> ... 22 more
> Caused by: java.lang.NullPointerException
> at com.sun.faces.facelets.impl.DefaultResourceResolver.resolveUrl(DefaultResourceResolver.java:40)
> at com.sun.faces.facelets.impl.DefaultFaceletFactory.init(DefaultFaceletFactory.java:129)
> at com.sun.faces.application.ApplicationAssociate.createFaceletFactory(ApplicationAssociate.java:849)
> at com.sun.faces.application.ApplicationAssociate.initializeFacelets(ApplicationAssociate.java:342)
> at com.sun.faces.application.ApplicationAssociate.getCompiler(ApplicationAssociate.java:420)
> at com.sun.faces.config.processor.FaceletTaglibConfigProcessor.process(FaceletTaglibConfigProcessor.java:217)
> at com.sun.faces.config.ConfigManager.initialize(ConfigManager.java:341)
> ... 23 more
> {quote}
> When adding an empty "beans.xml" file or any CDI annotated class, the error disappears.
> It also works when declaring JSF version 2.2.
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
5 years, 7 months
[JBoss JIRA] (WFCORE-4956) CVE-2020-10718 wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API
by Brian Stansberry (Jira)
[ https://issues.redhat.com/browse/WFCORE-4956?page=com.atlassian.jira.plug... ]
Brian Stansberry updated WFCORE-4956:
-------------------------------------
Description:
Security Tracking Issue
Impact: Low
Public Date: not set
Resolve Bug By: 545 calendar days from the public date
Flaw:
-----
EMBARGOED CVE-2020-10718 wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API
https://bugzilla.redhat.com/show_bug.cgi?id=1828476
The embedded managed process API has two methods exposed as public methods which can bypass the security manager.
was:
Security Tracking Issue
Do not make this issue public.
Impact: Low
Public Date: not set
Resolve Bug By: 545 calendar days from the public date
In case the dates above are already past, please evaluate this bug in your next prioritization review and make a decision then. Remember to explicitly set CLOSED:WONTFIX if you decide not to fix this bug.
Please see the Security Errata Policy for further details: https://docs.engineering.redhat.com/x/9RBqB
NOTE THIS ISSUE IS CURRENTLY EMBARGOED, DO NOT MAKE PUBLIC COMMITS OR COMMENTS ABOUT THIS ISSUE.
Flaw:
-----
EMBARGOED CVE-2020-10718 wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API
https://bugzilla.redhat.com/show_bug.cgi?id=1828476
The embedded managed process API has two methods exposed as public methods which can bypass the security manager.
> CVE-2020-10718 wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API
> ----------------------------------------------------------------------------------
>
> Key: WFCORE-4956
> URL: https://issues.redhat.com/browse/WFCORE-4956
> Project: WildFly Core
> Issue Type: Bug
> Components: Embedded
> Reporter: Kunjan Rathod
> Assignee: James Perkins
> Priority: Minor
> Labels: CVE-2020-10718, Security, SecurityTracking, downstream_dependency, pscomponent:wildfly
> Fix For: 13.0.0.Beta5
>
>
> Security Tracking Issue
> Impact: Low
> Public Date: not set
> Resolve Bug By: 545 calendar days from the public date
> Flaw:
> -----
> EMBARGOED CVE-2020-10718 wildfly: exposed setting of TCCL via the EmbeddedManagedProcess API
> https://bugzilla.redhat.com/show_bug.cgi?id=1828476
> The embedded managed process API has two methods exposed as public methods which can bypass the security manager.
--
This message was sent by Atlassian Jira
(v7.13.8#713008)
5 years, 7 months