Bug 13304

Summary:	[CVE 21] quartz 2.2.1 CVEs found
Product:	[ROSA-based products] ROSA Fresh	Reporter:	Yury <y.tumanov>
Component:	System (kernel, glibc, systemd, bash, PAM...)	Assignee:	ROSA Linux Bugs <bugs>
Status:	VERIFIED FIXED	QA Contact:	ROSA Linux Bugs <bugs>
Severity:	normal
Priority:	Normal	CC:	a.proklov, i.gaptrakhmanov, pastordidi, s.matveev, v.potapov, y.tumanov
Version:	All	Flags:	v.potapov: qa_verified+ y.tumanov: secteam_verified+ a.proklov: published+
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	CVE-2019-13990,
Whiteboard:
Platform:	2021.1	ROSA Vulnerability identifier:
RPM Package:		ISO-related:
Bad POT generating:		Upstream:

Description Yury 2023-05-03 18:02:14 MSK

Please patch CVEs for package quartz version 2.2.1
  
INFO (CVEs are): quartz 2.2.1
 cves found
CVE-2019-13990
Desc: initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.
Link: https://nvd.nist.gov/vuln/detail/CVE-2019-13990
Severity: CRITICAL

Comment 1 ilfat 2023-05-24 18:40:09 MSK

********** QA ADVISORY **********

CVE has been closed with a patch

https://abf.io/import/quartz/commit/af5b38c2bdd3950422990213d7e7386ed82b2471

https://abf.io/build_lists/4443767 aarch64
https://abf.io/build_lists/4443766 x86_64
https://abf.io/build_lists/4443768 i686 (Недопустимая архитектура)

Comment 2 Dmitry Postnikov 2023-05-25 14:13:52 MSK

***************************
The update sent to testings

Comment 3 Vladimir Potapov 2023-05-31 09:35:01 MSK

quartz-2.2.1-11
https://abf.io/build_lists/4443767 aarch64
https://abf.io/build_lists/4443766 x86_64
************************** Advisory ******************
CVE has been closed with a patch
******************************************************
QA Verified

Comment 4 Yury 2023-07-26 17:29:39 MSK

Secteam Verified