[Bug 951522] New: plexus-archiver: Uses embedded bzip implementation from apache-commons-compress (making it vulnerable against CVE-2012-2098 flaw and possibly others)
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=951522
Bug ID: 951522
Summary: plexus-archiver: Uses embedded bzip implementation
from apache-commons-compress (making it vulnerable
against CVE-2012-2098 flaw and possibly others)
Product: Fedora
Version: 18
Component: plexus-archiver
Severity: unspecified
Priority: unspecified
Assignee: jcapik(a)redhat.com
Reporter: jlieskov(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jcapik(a)redhat.com, mizdebsk(a)redhat.com
Depends On: 951521
Category: ---
+++ This bug was initially created as a clone of Bug #951521 +++
Description of problem:
Current version of plexus-archiver package in Fedora 18 contains embedded bzip2
code implementation within the included apache-commons-compress source, which
makes it vulnerable against the CVE-2012-2098 flaw (and possibly others).
Version-Release number of selected component (if applicable):
plexus-archiver-2.1.1-2.fc18
How reproducible:
Always
Steps to Reproduce:
1) Have a look at:
/root/rpmbuild/BUILD/sonatype-plexus-archiver-25364f5/src/main/java/org/codehaus/plexus/archiver/bzip2
2) Compare it with upstream patch for CVE-2012-2098:
[1] https://bugzilla.redhat.com/show_bug.cgi?id=810406#c17
Actual results:
Patch from [1] is applicable against (current) plexus-archiver package version
in Fedora 18 too.
Expected results:
plexus-archiver should use system version of the apache-commons-compress
package, which is available in Fedora 18 in order in case a similar flaw is
found in apache-commons-compress package, it would not be needed to patch both
(apache-commons-compress & plexus-archiver packages), but just to patch
apache-commons-compress package would be sufficient.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qtS1eeGwxx&a=cc_unsubscribe
10 years, 11 months