[smack/f20] - fix for CVE-2014-0363 (rhbz#1093274) - remove jzlib systemPath in smackx pom
by gil
commit 467557786643ca189d8ad04ff1a11e78ecb9cfab
Author: gil <puntogil(a)libero.it>
Date: Thu Dec 4 02:09:32 2014 +0100
- fix for CVE-2014-0363 (rhbz#1093274)
- remove jzlib systemPath in smackx pom
smack.spec | 6 +-----
1 files changed, 1 insertions(+), 5 deletions(-)
---
diff --git a/smack.spec b/smack.spec
index 516e814..6453f1d 100644
--- a/smack.spec
+++ b/smack.spec
@@ -28,7 +28,7 @@ Patch1: %{name}-3.2.2-CVE-2014-5075.patch
Patch2: %{name}-3.2.2-CVE-2014-0363.patch
BuildRequires: java-javadoc
-BuildRequires: javapackages-local
+BuildRequires: maven-local
BuildRequires: ant
BuildRequires: ant-contrib
@@ -38,11 +38,7 @@ BuildRequires: junit
BuildRequires: jzlib
BuildRequires: xmlunit
BuildRequires: xpp3
-%if %{?fedora} > 20
-BuildRequires: mvn(org.sonatype.oss:oss-parent:pom:)
-%else
BuildRequires: mvn(org.sonatype.oss:oss-parent)
-%endif
BuildArch: noarch
8 years, 3 months
[smack/f20: 6/6] - fix for CVE-2014-0363 (rhbz#1093274) - remove jzlib systemPath in smackx pom
by gil
commit e12a3a2a72a2374fb6ed96a89b545b61d2138d73
Merge: 8ff6a4d 48915f0
Author: gil <puntogil(a)libero.it>
Date: Thu Dec 4 01:59:20 2014 +0100
- fix for CVE-2014-0363 (rhbz#1093274)
- remove jzlib systemPath in smackx pom
smack-3.2.2-CVE-2014-0363.patch | 505 +++++++++++++++++++++++++++++++++++++++
smack.spec | 71 ++----
smackx-3.2.2.pom | 2 -
3 files changed, 529 insertions(+), 49 deletions(-)
---
diff --cc smack.spec
index 10b4d13,4b4dba0..516e814
--- a/smack.spec
+++ b/smack.spec
@@@ -1,7 -1,7 +1,7 @@@
%global pkg_version %(echo %version | tr . _)
Name: smack
Version: 3.2.2
- Release: 5%{?dist}
-Release: 8%{?dist}
++Release: 6%{?dist}
Summary: Open Source XMPP (Jabber) client library
License: ASL 2.0
URL: http://www.igniterealtime.org/projects/smack/index.jsp
@@@ -11,36 -11,25 +11,24 @@@ Source0: http://download.ignitere
# change version
# add xpp3
Source1: %{name}-%{version}.pom
--# add jzlib as system deps
Source2: %{name}x-%{version}.pom
Source3: %{name}x-debug-%{version}.pom
# unavailable test resources
# wget -O smack-3.2.2-test-config-test-case.xml http://svn.igniterealtime.org/svn/repos/smack/tags/smack_3_2_2/test/confi...
Source4: %{name}-%{version}-test-config-test-case.xml
+
# use system libraries
# disable jzlib and xpp3 repackage
-
# disable smack jingle extension. cause: unavailable deps
-
- # jingle/extension/build/lib/Speex.jar mil.jfcom.cie.media ?
- # jingle/extension/build/lib/jmf.jar replace with fmj
- # jingle/extension/build/lib/commons-logging-1.1.jar
- # jingle/extension/build/lib/commons-logging-adapters-1.1.jar
- # jingle/extension/build/lib/commons-logging-api-1.1.jar
- # jingle/extension/build/lib/jspeex-0.9.7-jfcom.jar org.xiph.speex
- # jingle/extension/build/merge/jstun.jar
- # jingle/extension/build/lib/junit.jar
-
# remove classpath from manifest files
# fix javadoc link
# fix build/javadoc/tests classpath
Patch0: %{name}-%{version}-build.patch
-
Patch1: %{name}-3.2.2-CVE-2014-5075.patch
+ Patch2: %{name}-3.2.2-CVE-2014-0363.patch
- BuildRequires: java-devel
BuildRequires: java-javadoc
- BuildRequires: jpackage-utils
+ BuildRequires: javapackages-local
BuildRequires: ant
BuildRequires: ant-contrib
@@@ -82,7 -71,11 +70,8 @@@ find . -name "*.jar" -print -delet
rm -rf javadoc/* documentation/*
%patch0 -p0
-%if %{?fedora} > 21
-sed -i.ant-contrib "s|%{_javadir}/ant/ant-contrib.jar|%{_javadir}/ant-contrib/ant-contrib.jar|" build/build.xml
-%endif
%patch1 -p1
+ %patch2 -p1
mkdir -p test/config
cp -p %{SOURCE4} test/config/test-case.xml
@@@ -140,9 -117,19 +113,13 @@@ rm -r test/org/jivesoftware/smack/ChatT
%doc README.html
%changelog
-* Thu Dec 04 2014 gil cattaneo <puntogil(a)libero.it> 3.2.2-8
++* Thu Dec 04 2014 gil cattaneo <puntogil(a)libero.it> 3.2.2-6
+ - fix for CVE-2014-0363 (rhbz#1093274)
+ - remove jzlib systemPath in smackx pom
+
-* Thu Aug 21 2014 gil cattaneo <puntogil(a)libero.it> 3.2.2-7
+* Thu Aug 21 2014 gil cattaneo <puntogil(a)libero.it> 3.2.2-5
- fix for CVE-2014-5075 (rhbz#1127277)
-* Sun Jun 08 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 3.2.2-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
-
-* Fri Mar 28 2014 Michael Simacek <msimacek(a)redhat.com> - 3.2.2-5
-- Use Requires: java-headless rebuild (#1067528)
-
* Sun Aug 04 2013 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 3.2.2-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
8 years, 3 months
[smack] - fix for CVE-2014-0363 (rhbz#1093274) - remove jzlib systemPath in smackx pom
by gil
commit 48915f05037f5c246878f9b6a6fab78bfcd6c86f
Author: gil <puntogil(a)libero.it>
Date: Thu Dec 4 01:01:28 2014 +0100
- fix for CVE-2014-0363 (rhbz#1093274)
- remove jzlib systemPath in smackx pom
smack-3.2.2-CVE-2014-0363.patch | 505 +++++++++++++++++++++++++++++++++++++++
smack.spec | 27 +--
smackx-3.2.2.pom | 2 -
3 files changed, 515 insertions(+), 19 deletions(-)
---
diff --git a/smack-3.2.2-CVE-2014-0363.patch b/smack-3.2.2-CVE-2014-0363.patch
new file mode 100644
index 0000000..c9a9b6e
--- /dev/null
+++ b/smack-3.2.2-CVE-2014-0363.patch
@@ -0,0 +1,505 @@
+diff -Nru smack_src_3_2_2/source/org/jivesoftware/smack/ConnectionConfiguration.java smack_src_3_2_2-gil/source/org/jivesoftware/smack/ConnectionConfiguration.java
+--- smack_src_3_2_2/source/org/jivesoftware/smack/ConnectionConfiguration.java 2014-08-21 13:26:03.380514185 +0200
++++ smack_src_3_2_2-gil/source/org/jivesoftware/smack/ConnectionConfiguration.java 2014-08-21 13:25:06.388343812 +0200
+@@ -26,7 +26,6 @@
+ import javax.net.SocketFactory;
+ import javax.net.ssl.HostnameVerifier;
+ import javax.security.auth.callback.CallbackHandler;
+-import java.io.File;
+
+ /**
+ * Configuration to use while establishing the connection to the server. It is possible to
+@@ -49,17 +48,9 @@
+ private String host;
+ private int port;
+
+- private String truststorePath;
+- private String truststoreType;
+- private String truststorePassword;
+ private String keystorePath;
+ private String keystoreType;
+ private String pkcs11Library;
+- private boolean verifyChainEnabled = false;
+- private boolean verifyRootCAEnabled = false;
+- private boolean selfSignedCertificateEnabled = false;
+- private boolean expiredCertificatesCheckEnabled = false;
+- private boolean notMatchingDomainCheckEnabled = false;
+
+ private boolean compressionEnabled = false;
+
+@@ -185,18 +176,6 @@
+ this.serviceName = serviceName;
+ this.proxy = proxy;
+
+- // Build the default path to the cacert truststore file. By default we are
+- // going to use the file located in $JREHOME/lib/security/cacerts.
+- String javaHome = System.getProperty("java.home");
+- StringBuilder buffer = new StringBuilder();
+- buffer.append(javaHome).append(File.separator).append("lib");
+- buffer.append(File.separator).append("security");
+- buffer.append(File.separator).append("cacerts");
+- truststorePath = buffer.toString();
+- // Set the default store type
+- truststoreType = "jks";
+- // Set the default password of the cacert file that is "changeit"
+- truststorePassword = "changeit";
+ keystorePath = System.getProperty("javax.net.ssl.keyStore");
+ keystoreType = "jks";
+ pkcs11Library = "pkcs11.config";
+@@ -265,66 +244,6 @@
+ }
+
+ /**
+- * Retuns the path to the trust store file. The trust store file contains the root
+- * certificates of several well known CAs. By default, will attempt to use the
+- * the file located in $JREHOME/lib/security/cacerts.
+- *
+- * @return the path to the truststore file.
+- */
+- public String getTruststorePath() {
+- return truststorePath;
+- }
+-
+- /**
+- * Sets the path to the trust store file. The truststore file contains the root
+- * certificates of several well?known CAs. By default Smack is going to use
+- * the file located in $JREHOME/lib/security/cacerts.
+- *
+- * @param truststorePath the path to the truststore file.
+- */
+- public void setTruststorePath(String truststorePath) {
+- this.truststorePath = truststorePath;
+- }
+-
+- /**
+- * Returns the trust store type, or <tt>null</tt> if it's not set.
+- *
+- * @return the trust store type.
+- */
+- public String getTruststoreType() {
+- return truststoreType;
+- }
+-
+- /**
+- * Sets the trust store type.
+- *
+- * @param truststoreType the trust store type.
+- */
+- public void setTruststoreType(String truststoreType) {
+- this.truststoreType = truststoreType;
+- }
+-
+- /**
+- * Returns the password to use to access the trust store file. It is assumed that all
+- * certificates share the same password in the trust store.
+- *
+- * @return the password to use to access the truststore file.
+- */
+- public String getTruststorePassword() {
+- return truststorePassword;
+- }
+-
+- /**
+- * Sets the password to use to access the trust store file. It is assumed that all
+- * certificates share the same password in the trust store.
+- *
+- * @param truststorePassword the password to use to access the truststore file.
+- */
+- public void setTruststorePassword(String truststorePassword) {
+- this.truststorePassword = truststorePassword;
+- }
+-
+- /**
+ * Retuns the path to the keystore file. The key store file contains the
+ * certificates that may be used to authenticate the client to the server,
+ * in the event the server requests or requires it.
+@@ -385,110 +304,6 @@
+ this.pkcs11Library = pkcs11Library;
+ }
+
+- /**
+- * Returns true if the whole chain of certificates presented by the server are going to
+- * be checked. By default the certificate chain is not verified.
+- *
+- * @return true if the whole chaing of certificates presented by the server are going to
+- * be checked.
+- */
+- public boolean isVerifyChainEnabled() {
+- return verifyChainEnabled;
+- }
+-
+- /**
+- * Sets if the whole chain of certificates presented by the server are going to
+- * be checked. By default the certificate chain is not verified.
+- *
+- * @param verifyChainEnabled if the whole chaing of certificates presented by the server
+- * are going to be checked.
+- */
+- public void setVerifyChainEnabled(boolean verifyChainEnabled) {
+- this.verifyChainEnabled = verifyChainEnabled;
+- }
+-
+- /**
+- * Returns true if root CA checking is going to be done. By default checking is disabled.
+- *
+- * @return true if root CA checking is going to be done.
+- */
+- public boolean isVerifyRootCAEnabled() {
+- return verifyRootCAEnabled;
+- }
+-
+- /**
+- * Sets if root CA checking is going to be done. By default checking is disabled.
+- *
+- * @param verifyRootCAEnabled if root CA checking is going to be done.
+- */
+- public void setVerifyRootCAEnabled(boolean verifyRootCAEnabled) {
+- this.verifyRootCAEnabled = verifyRootCAEnabled;
+- }
+-
+- /**
+- * Returns true if self-signed certificates are going to be accepted. By default
+- * this option is disabled.
+- *
+- * @return true if self-signed certificates are going to be accepted.
+- */
+- public boolean isSelfSignedCertificateEnabled() {
+- return selfSignedCertificateEnabled;
+- }
+-
+- /**
+- * Sets if self-signed certificates are going to be accepted. By default
+- * this option is disabled.
+- *
+- * @param selfSignedCertificateEnabled if self-signed certificates are going to be accepted.
+- */
+- public void setSelfSignedCertificateEnabled(boolean selfSignedCertificateEnabled) {
+- this.selfSignedCertificateEnabled = selfSignedCertificateEnabled;
+- }
+-
+- /**
+- * Returns true if certificates presented by the server are going to be checked for their
+- * validity. By default certificates are not verified.
+- *
+- * @return true if certificates presented by the server are going to be checked for their
+- * validity.
+- */
+- public boolean isExpiredCertificatesCheckEnabled() {
+- return expiredCertificatesCheckEnabled;
+- }
+-
+- /**
+- * Sets if certificates presented by the server are going to be checked for their
+- * validity. By default certificates are not verified.
+- *
+- * @param expiredCertificatesCheckEnabled if certificates presented by the server are going
+- * to be checked for their validity.
+- */
+- public void setExpiredCertificatesCheckEnabled(boolean expiredCertificatesCheckEnabled) {
+- this.expiredCertificatesCheckEnabled = expiredCertificatesCheckEnabled;
+- }
+-
+- /**
+- * Returns true if certificates presented by the server are going to be checked for their
+- * domain. By default certificates are not verified.
+- *
+- * @return true if certificates presented by the server are going to be checked for their
+- * domain.
+- */
+- public boolean isNotMatchingDomainCheckEnabled() {
+- return notMatchingDomainCheckEnabled;
+- }
+-
+- /**
+- * Sets if certificates presented by the server are going to be checked for their
+- * domain. By default certificates are not verified.
+- *
+- * @param notMatchingDomainCheckEnabled if certificates presented by the server are going
+- * to be checked for their domain.
+- */
+- public void setNotMatchingDomainCheckEnabled(boolean notMatchingDomainCheckEnabled) {
+- this.notMatchingDomainCheckEnabled = notMatchingDomainCheckEnabled;
+- }
+-
+ /**
+ * Set the HostnameVerifier used to verify the hostname of SSLSockets used by XMPP connections
+ * created with this ConnectionConfiguration.
+diff -Nru smack_src_3_2_2/source/org/jivesoftware/smack/ServerTrustManager.java smack_src_3_2_2-gil/source/org/jivesoftware/smack/ServerTrustManager.java
+--- smack_src_3_2_2/source/org/jivesoftware/smack/ServerTrustManager.java 2012-02-05 03:02:30.000000000 +0100
++++ smack_src_3_2_2-gil/source/org/jivesoftware/smack/ServerTrustManager.java 1970-01-01 01:00:00.000000000 +0100
+@@ -1,259 +0,0 @@
+-/**
+- * $RCSfile$
+- * $Revision: $
+- * $Date: $
+- *
+- * Copyright 2003-2005 Jive Software.
+- *
+- * All rights reserved. Licensed under the Apache License, Version 2.0 (the "License");
+- * you may not use this file except in compliance with the License.
+- * You may obtain a copy of the License at
+- *
+- * http://www.apache.org/licenses/LICENSE-2.0
+- *
+- * Unless required by applicable law or agreed to in writing, software
+- * distributed under the License is distributed on an "AS IS" BASIS,
+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+- * See the License for the specific language governing permissions and
+- * limitations under the License.
+- */
+-
+-package org.jivesoftware.smack;
+-
+-import javax.net.ssl.X509TrustManager;
+-import java.io.FileInputStream;
+-import java.io.InputStream;
+-import java.io.IOException;
+-import java.security.*;
+-import java.security.cert.CertificateException;
+-import java.security.cert.CertificateParsingException;
+-import java.security.cert.X509Certificate;
+-import java.util.*;
+-import java.util.regex.Matcher;
+-import java.util.regex.Pattern;
+-
+-/**
+- * Trust manager that checks all certificates presented by the server. This class
+- * is used during TLS negotiation. It is possible to disable/enable some or all checkings
+- * by configuring the {@link ConnectionConfiguration}. The truststore file that contains
+- * knows and trusted CA root certificates can also be configure in {@link ConnectionConfiguration}.
+- *
+- * @author Gaston Dombiak
+- */
+-class ServerTrustManager implements X509TrustManager {
+-
+- private static Pattern cnPattern = Pattern.compile("(?i)(cn=)([^,]*)");
+-
+- private ConnectionConfiguration configuration;
+-
+- /**
+- * Holds the domain of the remote server we are trying to connect
+- */
+- private String server;
+- private KeyStore trustStore;
+-
+- public ServerTrustManager(String server, ConnectionConfiguration configuration) {
+- this.configuration = configuration;
+- this.server = server;
+-
+- InputStream in = null;
+- try {
+- trustStore = KeyStore.getInstance(configuration.getTruststoreType());
+- in = new FileInputStream(configuration.getTruststorePath());
+- trustStore.load(in, configuration.getTruststorePassword().toCharArray());
+- }
+- catch (Exception e) {
+- e.printStackTrace();
+- // Disable root CA checking
+- configuration.setVerifyRootCAEnabled(false);
+- }
+- finally {
+- if (in != null) {
+- try {
+- in.close();
+- }
+- catch (IOException ioe) {
+- // Ignore.
+- }
+- }
+- }
+- }
+-
+- public X509Certificate[] getAcceptedIssuers() {
+- return new X509Certificate[0];
+- }
+-
+- public void checkClientTrusted(X509Certificate[] arg0, String arg1)
+- throws CertificateException {
+- }
+-
+- public void checkServerTrusted(X509Certificate[] x509Certificates, String arg1)
+- throws CertificateException {
+-
+- int nSize = x509Certificates.length;
+-
+- List<String> peerIdentities = getPeerIdentity(x509Certificates[0]);
+-
+- if (configuration.isVerifyChainEnabled()) {
+- // Working down the chain, for every certificate in the chain,
+- // verify that the subject of the certificate is the issuer of the
+- // next certificate in the chain.
+- Principal principalLast = null;
+- for (int i = nSize -1; i >= 0 ; i--) {
+- X509Certificate x509certificate = x509Certificates[i];
+- Principal principalIssuer = x509certificate.getIssuerDN();
+- Principal principalSubject = x509certificate.getSubjectDN();
+- if (principalLast != null) {
+- if (principalIssuer.equals(principalLast)) {
+- try {
+- PublicKey publickey =
+- x509Certificates[i + 1].getPublicKey();
+- x509Certificates[i].verify(publickey);
+- }
+- catch (GeneralSecurityException generalsecurityexception) {
+- throw new CertificateException(
+- "signature verification failed of " + peerIdentities);
+- }
+- }
+- else {
+- throw new CertificateException(
+- "subject/issuer verification failed of " + peerIdentities);
+- }
+- }
+- principalLast = principalSubject;
+- }
+- }
+-
+- if (configuration.isVerifyRootCAEnabled()) {
+- // Verify that the the last certificate in the chain was issued
+- // by a third-party that the client trusts.
+- boolean trusted = false;
+- try {
+- trusted = trustStore.getCertificateAlias(x509Certificates[nSize - 1]) != null;
+- if (!trusted && nSize == 1 && configuration.isSelfSignedCertificateEnabled())
+- {
+- System.out.println("Accepting self-signed certificate of remote server: " +
+- peerIdentities);
+- trusted = true;
+- }
+- }
+- catch (KeyStoreException e) {
+- e.printStackTrace();
+- }
+- if (!trusted) {
+- throw new CertificateException("root certificate not trusted of " + peerIdentities);
+- }
+- }
+-
+- if (configuration.isNotMatchingDomainCheckEnabled()) {
+- // Verify that the first certificate in the chain corresponds to
+- // the server we desire to authenticate.
+- // Check if the certificate uses a wildcard indicating that subdomains are valid
+- if (peerIdentities.size() == 1 && peerIdentities.get(0).startsWith("*.")) {
+- // Remove the wildcard
+- String peerIdentity = peerIdentities.get(0).replace("*.", "");
+- // Check if the requested subdomain matches the certified domain
+- if (!server.endsWith(peerIdentity)) {
+- throw new CertificateException("target verification failed of " + peerIdentities);
+- }
+- }
+- else if (!peerIdentities.contains(server)) {
+- throw new CertificateException("target verification failed of " + peerIdentities);
+- }
+- }
+-
+- if (configuration.isExpiredCertificatesCheckEnabled()) {
+- // For every certificate in the chain, verify that the certificate
+- // is valid at the current time.
+- Date date = new Date();
+- for (int i = 0; i < nSize; i++) {
+- try {
+- x509Certificates[i].checkValidity(date);
+- }
+- catch (GeneralSecurityException generalsecurityexception) {
+- throw new CertificateException("invalid date of " + server);
+- }
+- }
+- }
+-
+- }
+-
+- /**
+- * Returns the identity of the remote server as defined in the specified certificate. The
+- * identity is defined in the subjectDN of the certificate and it can also be defined in
+- * the subjectAltName extension of type "xmpp". When the extension is being used then the
+- * identity defined in the extension in going to be returned. Otherwise, the value stored in
+- * the subjectDN is returned.
+- *
+- * @param x509Certificate the certificate the holds the identity of the remote server.
+- * @return the identity of the remote server as defined in the specified certificate.
+- */
+- public static List<String> getPeerIdentity(X509Certificate x509Certificate) {
+- // Look the identity in the subjectAltName extension if available
+- List<String> names = getSubjectAlternativeNames(x509Certificate);
+- if (names.isEmpty()) {
+- String name = x509Certificate.getSubjectDN().getName();
+- Matcher matcher = cnPattern.matcher(name);
+- if (matcher.find()) {
+- name = matcher.group(2);
+- }
+- // Create an array with the unique identity
+- names = new ArrayList<String>();
+- names.add(name);
+- }
+- return names;
+- }
+-
+- /**
+- * Returns the JID representation of an XMPP entity contained as a SubjectAltName extension
+- * in the certificate. If none was found then return <tt>null</tt>.
+- *
+- * @param certificate the certificate presented by the remote entity.
+- * @return the JID representation of an XMPP entity contained as a SubjectAltName extension
+- * in the certificate. If none was found then return <tt>null</tt>.
+- */
+- private static List<String> getSubjectAlternativeNames(X509Certificate certificate) {
+- List<String> identities = new ArrayList<String>();
+- try {
+- Collection<List<?>> altNames = certificate.getSubjectAlternativeNames();
+- // Check that the certificate includes the SubjectAltName extension
+- if (altNames == null) {
+- return Collections.emptyList();
+- }
+- // Use the type OtherName to search for the certified server name
+- /*for (List item : altNames) {
+- Integer type = (Integer) item.get(0);
+- if (type == 0) {
+- // Type OtherName found so return the associated value
+- try {
+- // Value is encoded using ASN.1 so decode it to get the server's identity
+- ASN1InputStream decoder = new ASN1InputStream((byte[]) item.toArray()[1]);
+- DEREncodable encoded = decoder.readObject();
+- encoded = ((DERSequence) encoded).getObjectAt(1);
+- encoded = ((DERTaggedObject) encoded).getObject();
+- encoded = ((DERTaggedObject) encoded).getObject();
+- String identity = ((DERUTF8String) encoded).getString();
+- // Add the decoded server name to the list of identities
+- identities.add(identity);
+- }
+- catch (UnsupportedEncodingException e) {
+- // Ignore
+- }
+- catch (IOException e) {
+- // Ignore
+- }
+- catch (Exception e) {
+- e.printStackTrace();
+- }
+- }
+- // Other types are not good for XMPP so ignore them
+- System.out.println("SubjectAltName of invalid type found: " + certificate);
+- }*/
+- }
+- catch (CertificateParsingException e) {
+- e.printStackTrace();
+- }
+- return identities;
+- }
+-
+-}
+diff -Nru smack_src_3_2_2/source/org/jivesoftware/smack/XMPPConnection.java smack_src_3_2_2-gil/source/org/jivesoftware/smack/XMPPConnection.java
+--- smack_src_3_2_2/source/org/jivesoftware/smack/XMPPConnection.java 2014-08-21 13:26:03.381514135 +0200
++++ smack_src_3_2_2-gil/source/org/jivesoftware/smack/XMPPConnection.java 2014-08-21 13:18:32.329908422 +0200
+@@ -792,9 +792,9 @@
+ }
+
+ // Verify certificate presented by the server
+- context.init(kms,
+- new javax.net.ssl.TrustManager[]{new ServerTrustManager(getServiceName(), config)},
+- new java.security.SecureRandom());
++ if (context == null) {
++ context.init(kms, null, new java.security.SecureRandom());
++ }
+ Socket plain = socket;
+ // Secure the plain connection
+ socket = context.getSocketFactory().createSocket(plain,
diff --git a/smack.spec b/smack.spec
index ec4118e..4b4dba0 100644
--- a/smack.spec
+++ b/smack.spec
@@ -1,7 +1,7 @@
%global pkg_version %(echo %version | tr . _)
Name: smack
Version: 3.2.2
-Release: 7%{?dist}
+Release: 8%{?dist}
Summary: Open Source XMPP (Jabber) client library
License: ASL 2.0
URL: http://www.igniterealtime.org/projects/smack/index.jsp
@@ -17,26 +17,16 @@ Source3: %{name}x-debug-%{version}.pom
# unavailable test resources
# wget -O smack-3.2.2-test-config-test-case.xml http://svn.igniterealtime.org/svn/repos/smack/tags/smack_3_2_2/test/confi...
Source4: %{name}-%{version}-test-config-test-case.xml
-
# use system libraries
# disable jzlib and xpp3 repackage
-
# disable smack jingle extension. cause: unavailable deps
-
-# jingle/extension/build/lib/Speex.jar mil.jfcom.cie.media ?
-# jingle/extension/build/lib/jmf.jar replace with fmj
-# jingle/extension/build/lib/commons-logging-1.1.jar
-# jingle/extension/build/lib/commons-logging-adapters-1.1.jar
-# jingle/extension/build/lib/commons-logging-api-1.1.jar
-# jingle/extension/build/lib/jspeex-0.9.7-jfcom.jar org.xiph.speex
-# jingle/extension/build/merge/jstun.jar
-# jingle/extension/build/lib/junit.jar
-
# remove classpath from manifest files
# fix javadoc link
# fix build/javadoc/tests classpath
Patch0: %{name}-%{version}-build.patch
+
Patch1: %{name}-3.2.2-CVE-2014-5075.patch
+Patch2: %{name}-3.2.2-CVE-2014-0363.patch
BuildRequires: java-javadoc
BuildRequires: javapackages-local
@@ -85,13 +75,12 @@ rm -rf javadoc/* documentation/*
sed -i.ant-contrib "s|%{_javadir}/ant/ant-contrib.jar|%{_javadir}/ant-contrib/ant-contrib.jar|" build/build.xml
%endif
%patch1 -p1
+%patch2 -p1
mkdir -p test/config
cp -p %{SOURCE4} test/config/test-case.xml
# tests problem:
-# [junit] XMPPError connecting to localhost:5222.: remote-server-error(502)
-# XMPPError connecting to localhost:5222.
-# [junit] -- caused by: java.net.ConnectException: Connection refused
+# caused by: java.net.ConnectException: Connection refused
# remove this file unavailable class, in this release isn't available. error: cannot find symbol
# [javac] import org.jivesoftware.smackx.bytestreams.socks5.Socks5PacketUtils;
rm -r test/org/jivesoftware/smackx/bytestreams/socks5/Socks5ByteStreamTest.java
@@ -107,7 +96,7 @@ rm -r test/org/jivesoftware/smack/ChatTest.java \
test/org/jivesoftware/smack/RosterListenerTest.java \
test/org/jivesoftware/smack/RosterSmackTest.java \
test/org/jivesoftware/smack/RosterInitializedBeforeConnectTest.java \
- test/org/jivesoftware/smack/packet/PrivacyTest.java \
+ test/org/jivesoftware/smack/packet/PrivacyTest.java
%build
@@ -128,6 +117,10 @@ rm -r test/org/jivesoftware/smack/ChatTest.java \
%doc README.html
%changelog
+* Thu Dec 04 2014 gil cattaneo <puntogil(a)libero.it> 3.2.2-8
+- fix for CVE-2014-0363 (rhbz#1093274)
+- remove jzlib systemPath in smackx pom
+
* Thu Aug 21 2014 gil cattaneo <puntogil(a)libero.it> 3.2.2-7
- fix for CVE-2014-5075 (rhbz#1127277)
diff --git a/smackx-3.2.2.pom b/smackx-3.2.2.pom
index 70f86b2..55e02d5 100644
--- a/smackx-3.2.2.pom
+++ b/smackx-3.2.2.pom
@@ -43,8 +43,6 @@
<groupId>com.jcraft</groupId>
<artifactId>jzlib</artifactId>
<version>1.0.7</version>
- <scope>system</scope>
- <systemPath>/usr/share/java/jzlib.jar</systemPath>
</dependency>
<dependency>
<groupId>org.igniterealtime.smack</groupId>
8 years, 3 months
[Bug 1093274] New: CVE-2014-0363 smack: incorrect X.509 validation [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1093274
Bug ID: 1093274
Summary: CVE-2014-0363 smack: incorrect X.509 validation
[fedora-all]
Product: Fedora
Version: 20
Component: smack
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: puntogil(a)libero.it
Reporter: mmcallis(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Blocks: 1093273 (CVE-2014-0363)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
[Bug 1093273] CVE-2014-0363 smack: incorrect X.509 validation
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=7My14W5YkM&a=cc_unsubscribe
8 years, 3 months
[httpcomponents-client] Bump release
by Michael Šimáček
commit 52b116fbb8c14a7e39f326cd7d3329d97b071e41
Author: Michael Simacek <msimacek(a)redhat.com>
Date: Tue Dec 2 22:45:40 2014 +0100
Bump release
httpcomponents-client.spec | 5 ++++-
1 files changed, 4 insertions(+), 1 deletions(-)
---
diff --git a/httpcomponents-client.spec b/httpcomponents-client.spec
index b3aaa2c..c1d258c 100644
--- a/httpcomponents-client.spec
+++ b/httpcomponents-client.spec
@@ -3,7 +3,7 @@
Name: httpcomponents-client
Summary: HTTP agent implementation based on httpcomponents HttpCore
Version: 4.3.5
-Release: 1%{?dist}
+Release: 2%{?dist}
License: ASL 2.0
URL: http://hc.apache.org/
Source0: http://www.apache.org/dist/httpcomponents/httpclient/source/%{name}-%{ver...
@@ -121,6 +121,9 @@ rm httpclient/src/test/java/org/apache/http/client/config/TestRequestConfig.java
%doc LICENSE.txt NOTICE.txt
%changelog
+* Tue Dec 02 2014 Michael Simacek <msimacek(a)redhat.com> - 4.3.5-2
+- Build and install tests artifact (needed by copr-java)
+
* Tue Aug 5 2014 Mikolaj Izdebski <mizdebsk(a)redhat.com> - 4.3.5-1
- Update to upstream version 4.3.5
8 years, 3 months
[httpcomponents-client] Build and install tests artifact (needed by copr-java)
by Michael Šimáček
commit 26f99a1a13f43110b239cebdb76f58752323be31
Author: Michael Simacek <msimacek(a)redhat.com>
Date: Fri Nov 28 15:25:38 2014 +0100
Build and install tests artifact (needed by copr-java)
httpcomponents-client.spec | 23 +++++++++++++++++------
1 files changed, 17 insertions(+), 6 deletions(-)
---
diff --git a/httpcomponents-client.spec b/httpcomponents-client.spec
index 020229e..b3aaa2c 100644
--- a/httpcomponents-client.spec
+++ b/httpcomponents-client.spec
@@ -16,6 +16,7 @@ BuildRequires: mvn(commons-logging:commons-logging)
BuildRequires: mvn(org.apache.httpcomponents:httpcore)
BuildRequires: mvn(org.apache.httpcomponents:project:pom:)
BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin)
+BuildRequires: mvn(org.mockito:mockito-core)
%description
HttpClient is a HTTP/1.1 compliant HTTP agent implementation based on
@@ -31,12 +32,20 @@ Summary: API documentation for %{name}
%description javadoc
%{summary}.
+%package tests
+Summary: Classes for testing client applications
+
+%description tests
+Classes for testing client applications.
+
%prep
%setup -q
-# Don't install javadoc, sources and tests jars
-%mvn_package ":{*}::{tests,sources,javadoc}:" __noinstall
+# Don't install javadoc and sources jars
+%mvn_package ":{*}::{sources,javadoc}:" __noinstall
+
+%mvn_package ":{*}::tests:" tests
# Remove optional build deps not available in Fedora
%pom_disable_module httpclient-cache
@@ -45,7 +54,6 @@ Summary: API documentation for %{name}
%pom_remove_plugin :docbkx-maven-plugin
%pom_remove_plugin :clirr-maven-plugin
%pom_remove_plugin :maven-checkstyle-plugin
-%pom_remove_dep :mockito-core httpclient
# Add proper Apache felix bundle plugin instructions
# so that we get a reasonable OSGi manifest.
@@ -91,13 +99,13 @@ done
</configuration>
</plugin>" httpclient
-
+# requires network
+rm httpclient/src/test/java/org/apache/http/client/config/TestRequestConfig.java
%build
%mvn_file ":{*}" httpcomponents/@1
-# tests are disabled due to bug in mockito (rhbz#1040350)
-%mvn_build -f
+%mvn_build
%install
%mvn_install
@@ -106,6 +114,9 @@ done
%files -f .mfiles
%doc LICENSE.txt NOTICE.txt README.txt RELEASE_NOTES.txt
+%files tests -f .mfiles-tests
+%doc LICENSE.txt NOTICE.txt README.txt RELEASE_NOTES.txt
+
%files javadoc -f .mfiles-javadoc
%doc LICENSE.txt NOTICE.txt
8 years, 3 months