[Bug 951521] New: plexus-archiver: Uses embedded bzip implementation from apache-commons-compress (making it vulnerable against CVE-2012-2098 flaw and possibly others)
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=951521
Bug ID: 951521
Summary: plexus-archiver: Uses embedded bzip implementation
from apache-commons-compress (making it vulnerable
against CVE-2012-2098 flaw and possibly others)
Product: Fedora
Version: 17
Component: plexus-archiver
Severity: unspecified
Priority: unspecified
Assignee: jcapik(a)redhat.com
Reporter: jlieskov(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jcapik(a)redhat.com, mizdebsk(a)redhat.com
Category: ---
Description of problem:
Current version of plexus-archiver package in Fedora 17 contains embedded bzip2
code implementation within the included apache-commons-compress source, which
makes it vulnerable against the CVE-2012-2098 flaw (and possibly others).
Version-Release number of selected component (if applicable):
plexus-archiver-2.1-1.fc17
How reproducible:
Always
Steps to Reproduce:
1) Have a look at:
/root/rpmbuild/BUILD/sonatype-plexus-archiver-25364f5/src/main/java/org/codehaus/plexus/archiver/bzip2
2) Compare it with upstream patch for CVE-2012-2098:
[1] https://bugzilla.redhat.com/show_bug.cgi?id=810406#c17
Actual results:
Patch from [1] is applicable against (current) plexus-archiver package version
in Fedora 17 too.
Expected results:
plexus-archiver should use system version of the apache-commons-compress
package, which is available in Fedora 17 in order in case a similar flaw is
found in apache-commons-compress package, it would not be needed to patch both
(apache-commons-compress & plexus-archiver packages), but just to patch
apache-commons-compress package would be sufficient.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=oS0s0j6lhT&a=cc_unsubscribe
10 years, 11 months
[Bug 948728] New: maven: mvn-rpmbuild: line 12: tar: command not found
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=948728
Bug ID: 948728
Summary: maven: mvn-rpmbuild: line 12: tar: command not found
Product: Fedora
Version: 17
Component: maven
Severity: unspecified
Priority: unspecified
Assignee: sochotni(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
sochotni(a)redhat.com, tradej(a)redhat.com
Category: ---
Description of problem:
/usr/bin/mvn-rpmbuild calls tar utility, but does not depend on tar package.
Version-Release number of selected component (if applicable):
all maintained versions
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=QmjRC088Fc&a=cc_unsubscribe
10 years, 11 months
[Bug 958161] New: maven-dependency-tree: migrate from aether to its subpackages
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=958161
Bug ID: 958161
Summary: maven-dependency-tree: migrate from aether to its
subpackages
Product: Fedora
Version: rawhide
Component: maven-dependency-tree
Severity: unspecified
Priority: unspecified
Assignee: sochotni(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
sochotni(a)redhat.com, tradej(a)redhat.com
Blocks: 958143
Category: ---
Please migrate maven-dependency-tree from aether to appropriate subpackages of
aether.
Package maven-dependency-tree requires or build-requires aether, which has been
recently split into multiple subpackages. Please replace (Build)Requires:
aether with requires on appropriate subpackages of aether.
Version-Release number of selected component (if applicable):
2.0-4
Additional info:
See bug #958143 for bore information.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=3h5qizcGmm&a=cc_unsubscribe
10 years, 11 months
[Bug 958160] New: maven: migrate from aether to its subpackages
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=958160
Bug ID: 958160
Summary: maven: migrate from aether to its subpackages
Product: Fedora
Version: rawhide
Component: maven
Severity: unspecified
Priority: unspecified
Assignee: sochotni(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
sochotni(a)redhat.com, tradej(a)redhat.com
Blocks: 958143
Category: ---
Please migrate maven from aether to appropriate subpackages of aether.
Package maven requires or build-requires aether, which has been recently split
into multiple subpackages. Please replace (Build)Requires: aether with
requires on appropriate subpackages of aether.
Version-Release number of selected component (if applicable):
3.0.5-4
Additional info:
See bug #958143 for bore information.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=gwLazI5KAj&a=cc_unsubscribe
10 years, 11 months