[Bug 1069921] CVE-2013-4286 tomcat: incomplete fix for CVE-2005-2090
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1069921
--- Doc Text *updated* ---
==tomcat
Tomcat was found to accept content-length headers with chunked encoding over any HTTP connector and multiple content-length headers in a request when using the AJP connector. This could allow attackers to poison a web-cache, bypass web application firewall protection, or conduct cross-site scripting attacks.
==jbossweb
It was found that when JBoss Web processed a series of HTTP requests in
which at least one request contained either multiple content-length
headers, or one content-length header with a chunked transfer-encoding
header, JBoss Web would incorrectly handle the request. A remote attacker
could use this flaw to poison a web cache, perform cross-site scripting
(XSS) attacks, or obtain sensitive information from other requests.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=jJI07ChxsX&a=cc_unsubscribe
10 years
[jenkins] First acegisecurity experiment
by Michal Srb
commit 42fd0f4ed3e10427bdc5b2497c89baae135bce75
Author: Michal Srb <msrb(a)redhat.com>
Date: Mon Mar 31 16:16:13 2014 +0200
First acegisecurity experiment
jenkins.spec | 29 +++++++++++++++++------------
1 files changed, 17 insertions(+), 12 deletions(-)
---
diff --git a/jenkins.spec b/jenkins.spec
index 1c26477..dfee998 100644
--- a/jenkins.spec
+++ b/jenkins.spec
@@ -5,7 +5,7 @@
Name: jenkins
Version: 1.549
-Release: 7%{?dist}
+Release: 8%{?dist}
Summary: An extendable open source continuous integration server
# The project's primary license is MIT
@@ -28,7 +28,7 @@ Source3: BSD-LICENSE
Source4: jenkins-sysconfig
# we don't have legacy acegi security framework in Fedora
-Patch0: use-spring-security.patch
+#Patch0: use-spring-security.patch
# animal sniffer is not really useful in Fedora
Patch1: remove-animal-sniffer-annotations.patch
# build agaist pristine trilead-ssh2 library
@@ -50,7 +50,7 @@ Patch9: upgrade-to-commons-io-2.4.patch
# newer args4j
Patch10: use-args4j-2.0.25.patch
# switch to spring security in groovy scripts
-Patch11: groovy-scripts-to-spring-security.patch
+#Patch11: groovy-scripts-to-spring-security.patch
# build against newer guava
Patch12: use-guava-13.0.patch
# remove windows support (for now)
@@ -61,9 +61,9 @@ Patch16: remove-windows-installer-support.patch
# exclude pristine xstream from build (Fedora specific, we use different lib than upstream)
Patch17: exclude-xstream.patch
# spring security related patches
-Patch18: spring-security-in-SecurityListener.patch
-Patch19: fix-in-HttpSessionContextIntegrationFilter2.patch
-Patch20: fix-in-AuthenticationProcessingFilter2.patch
+#Patch18: spring-security-in-SecurityListener.patch
+#Patch19: fix-in-HttpSessionContextIntegrationFilter2.patch
+#Patch20: fix-in-AuthenticationProcessingFilter2.patch
BuildArch: noarch
@@ -152,6 +152,7 @@ BuildRequires: mvn(org.apache.maven.plugins:maven-war-plugin)
BuildRequires: mvn(org.apache.sshd:sshd-core)
BuildRequires: mvn(org.bouncycastle:bcprov-jdk16)
BuildRequires: mvn(org.bouncycastle:bcpkix-jdk15on)
+BuildRequires: mvn(org.acegisecurity:acegi-security)
%if !%{bootstrap}
#BuildRequires: mvn(org.jenkins-ci.lib:lib-jenkins-maven-embedder)
BuildRequires: mvn(org.jenkins-ci.main:cli)
@@ -354,6 +355,7 @@ Requires: jenkins-crypto-util
Requires: glassfish-jaxb
Requires: geronimo-validation
Requires: js-yui2
+Requires: acegisecurity
%description webapp
@@ -370,7 +372,7 @@ This package contains API documentation for %{name}.
%prep
%setup -q -n %{name}-%{name}-%{version}
-%patch0 -p1
+#%%patch0 -p1
%patch1 -p1
%patch2 -p1
%patch3 -p1
@@ -381,16 +383,16 @@ This package contains API documentation for %{name}.
%patch8 -p1
%patch9 -p1
%patch10 -p1
-%patch11 -p1
+#%%patch11 -p1
%patch12 -p1
%patch13 -p1
%patch14 -p1
%patch15 -p1
%patch16 -p1
-%patch17 -p1
-%patch18 -p1
-%patch19 -p1
-%patch20 -p1
+%patch17 -p1 -F3
+#%%patch18 -p1
+#%%patch19 -p1
+#%%patch20 -p1
# Remove bundled JARs and classes
find . -name "*.jar" -delete
@@ -580,6 +582,9 @@ cp -p %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/tomcat@%{name}
%doc LICENSE.txt
%changelog
+* Mon Mar 31 2014 Michal Srb <msrb(a)redhat.com> - 1.549-8
+- First acegisecurity experiment
+
* Mon Mar 31 2014 Michal Srb <msrb(a)redhat.com> - 1.549-7
- Symlink tomcat's work dir
10 years
[jenkins] Symlink tomcat's work dir
by Michal Srb
commit 22846e9900946d568c160d3e73b53267ddddd549
Author: Michal Srb <msrb(a)redhat.com>
Date: Mon Mar 31 16:05:23 2014 +0200
Symlink tomcat's work dir
jenkins.spec | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
---
diff --git a/jenkins.spec b/jenkins.spec
index 7358d99..1c26477 100644
--- a/jenkins.spec
+++ b/jenkins.spec
@@ -5,7 +5,7 @@
Name: jenkins
Version: 1.549
-Release: 6%{?dist}
+Release: 7%{?dist}
Summary: An extendable open source continuous integration server
# The project's primary license is MIT
@@ -545,7 +545,7 @@ popd
# symlink the webapp to /var/lib/tomcats/jenkins
# so we can run it via "systemctl start tomcat@jenkins"
pushd %{buildroot}/%{jenkins_catalina_base}
- for i in conf lib logs; do
+ for i in conf lib logs work; do
ln -s %{_datadir}/tomcat/$i $i
done
@@ -580,6 +580,9 @@ cp -p %{SOURCE4} %{buildroot}%{_sysconfdir}/sysconfig/tomcat@%{name}
%doc LICENSE.txt
%changelog
+* Mon Mar 31 2014 Michal Srb <msrb(a)redhat.com> - 1.549-7
+- Symlink tomcat's work dir
+
* Thu Mar 27 2014 Michal Srb <msrb(a)redhat.com> - 1.549-6
- Unbundle yui
- Install proper sysconfig
10 years
[jenkins-remoting] Update to upstream version 2.35
by Michal Srb
commit 7fcd3168b9e2dcb9215f00bae6d0cc528b21691c
Author: Michal Srb <msrb(a)redhat.com>
Date: Tue Apr 1 08:06:11 2014 +0200
Update to upstream version 2.35
.gitignore | 1 +
jenkins-remoting.spec | 7 +++++--
sources | 2 +-
3 files changed, 7 insertions(+), 3 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index 21621be..604aa3a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
/remoting-2.32.tar.gz
/remoting-2.33.tar.gz
/remoting-2.34.tar.gz
+/remoting-2.35.tar.gz
diff --git a/jenkins-remoting.spec b/jenkins-remoting.spec
index 720d189..0c821c5 100644
--- a/jenkins-remoting.spec
+++ b/jenkins-remoting.spec
@@ -1,8 +1,8 @@
%global shortname remoting
Name: jenkins-remoting
-Version: 2.34
-Release: 1%{?dist}
+Version: 2.35
+Release: 2%{?dist}
Summary: Jenkins remoting module
# License is specified in pom file
@@ -83,6 +83,9 @@ cp %{SOURCE2} .
%doc LICENSE-MIT LICENSE-ASL
%changelog
+* Tue Apr 01 2014 Michal Srb <msrb(a)redhat.com> - 2.35-2
+- Update to upstream version 2.35
+
* Fri Dec 06 2013 Michal Srb <msrb(a)redhat.com> - 2.34-1
- Update to upstream version 2.34
diff --git a/sources b/sources
index 8965ab0..1a48e9c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
3b83ef96387f14655fc854ddc3c6bd57 LICENSE-2.0.txt
-75e7f5585dde8c5803ae8b0108b08276 remoting-2.34.tar.gz
+9ee7c6eec17d8211be74d32b2b2d9c7e remoting-2.35.tar.gz
10 years