[Bug 1093277] New: CVE-2014-0364 smack: IQ response spoofing [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1093277
Bug ID: 1093277
Summary: CVE-2014-0364 smack: IQ response spoofing [fedora-all]
Product: Fedora
Version: 20
Component: smack
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: puntogil(a)libero.it
Reporter: mmcallis(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Blocks: 1093276 (CVE-2014-0364)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1093276
[Bug 1093276] CVE-2014-0364 smack: IQ response spoofing
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5tK249Hde4&a=cc_unsubscribe
9 years, 4 months
[Bug 1048608] New: Tomcat console output is not going to ${CATALINA_BASE}/logs/catalina.out
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1048608
Bug ID: 1048608
Summary: Tomcat console output is not going to
${CATALINA_BASE}/logs/catalina.out
Product: Fedora
Version: 20
Component: tomcat
Severity: high
Assignee: ivan.afonichev(a)gmail.com
Reporter: karthic_babu(a)hotmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Description of problem: Tomcat console output (System.out and System.err) are
not going to ${CATALINA_BASE}/logs/catalina.out. As per Apache Tomcat
documentation (http://tomcat.apache.org/tomcat-7.0-doc/logging.html#Console),
console messages go to ${CATALINA_BASE}/logs/catalina.out Previous versions of
fedora outputs to /usr/share/tomcat/logs/catalina.out
Version-Release number of selected component (if applicable):
How reproducible:
All times
Steps to Reproduce:
1. Develop a simple tomcat web application. Add debug statements in servlet
that prints to System.out or System.err.
2. Deploy it to tomcat server on Fedora 20 and start the tomcat server
3. Invoke the servlet.
Actual results:
No file appears /usr/share/tomcat/logs/catalina.out
Expected results:
Debug statements put on System.out and System.err shall appear in file
/usr/share/tomcat/logs/catalina.out
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=b9abB1daz3&a=cc_unsubscribe
9 years, 5 months
[Bug 1132224] New: java-functions cannot handle spaces in flags/options
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1132224
Bug ID: 1132224
Summary: java-functions cannot handle spaces in flags/options
Product: Fedora
Version: 21
Component: javapackages-tools
Assignee: mizdebsk(a)redhat.com
Reporter: ctubbsii-fedora(a)apache.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com
Description of problem:
set_flags and set_options in /usr/share/java-utils/java-functions cannot handle
options with spaces.
Version-Release number of selected component (if applicable):
javapackages-tools-4.1.0-2.fc21.noarch (probably affects other versions as
well)
How reproducible:
100%
Steps to Reproduce:
1. Create an application script (using %jpackage_script maybe)
2. Observe the generated script
Actual results:
There's a few issues.
First, the generated output for %jpackage_script assigns the variables
BASE_FLAGS and BASE_OPTIONS as strings instead of arrays. (This probably also
affects BASE_JARS, but the nature of that limits the likelihood that it will
contain individual elements with spaces.)
Second, the $BASE_FLAGS and $BASE_OPTIONS are passed as arguments to set_flags
and set_options functions, respectively, without passing as arrays.
Third, the set_flags and set_options functions themselves flatten their
arguments to a string for use later when passing to the $JAVA_CMD.
Fourth, internal values of $OPTIONS and $FLAGS are passed to $JAVA_CMD as a
string.
This is a big limitation, because some arguments may have spaces, such as
"-XX:OnOutOfMemoryError=kill -9 %s", which does not seem to be capable of
properly quoting/escaping to pass all the way through to the exec line.
Expected results:
The arguments should be carried as arrays throughout, so they can be properly
passed to the $JAVA_CMD.
Example:
BASE_FLAGS=("%5") # (assuming %5 is the rpm argument)
set_flags "${BASE_FLAGS[@]}"
set_flags() {
FLAGS=("$@")
}
exec $JAVA_CMD "${FLAGS[@]}" ...
Additional info:
When used with %jpackage_script, one cannot put spaces into arguments in the
first place... unless one defines a macro. This is a limitation of rpm, but the
macro is a reasonable workaround.
I could not find an upstream issue tracker or bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=qQdKr31DKb&a=cc_unsubscribe
9 years, 5 months
[Bug 1094583] New: javapackages-tools: mvn_artifact: Empty version encountered in dependency
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1094583
Bug ID: 1094583
Summary: javapackages-tools: mvn_artifact: Empty version
encountered in dependency
Product: Fedora
Version: rawhide
Component: javapackages-tools
Assignee: msrb(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com
Description of problem:
mvn_artifact fails with the following error:
+ python /usr/share/java-utils/mvn_artifact.py
output/dist/lib/asm-analysis-5.0.2.pom output/dist/lib/asm-analysis-5.0.2.jar
Traceback (most recent call last):
File "/usr/share/java-utils/mvn_artifact.py", line 183, in <module>
deps.extend([x for x in p.get_dependencies()])
File "/usr/lib/python2.7/site-packages/javapackages/pom.py", line 181, in
get_dependencies
adep = Dependency.from_xml_element(dep, create_all=get_all)
File "/usr/lib/python2.7/site-packages/javapackages/artifact.py", line 566,
in from_xml_element
format(dep=a.get_mvn_str()))
javapackages.artifact.ArtifactFormatException: Empty version encountered in
dependency: org.ow2.asm:asm-tree
Version-Release number of selected component (if applicable):
3.6.0-0.244.git9f2cc08
How reproducible:
Build objectweb-asm 5.0.2-1
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=88m9MkwoZP&a=cc_unsubscribe
9 years, 5 months
[Bug 922147] New: CVE-2013-0248 jakarta-commons-fileupload, apache-commons-fileupload: /tmp directory used by default for uploaded files (possibility to overwrite arbitrary files) [fedora-all]
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=922147
Bug ID: 922147
Summary: CVE-2013-0248 jakarta-commons-fileupload,
apache-commons-fileupload: /tmp directory used by
default for uploaded files (possibility to overwrite
arbitrary files) [fedora-all]
Product: Fedora
Version: 18
Component: apache-commons-fileupload
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: mizdebsk(a)redhat.com
Reporter: jlieskov(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com, sochotni(a)redhat.com,
SpikeFedora(a)gmail.com, tradej(a)redhat.com
Blocks: 922146 (CVE-2013-0248)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects multiple supported versions of Fedora.
Only one tracking bug has been filed; please ensure that it is only closed
when all affected versions are fixed.
[bug automatically created by: add-tracking-bugs]
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=i2Ts9FpsI9&a=cc_unsubscribe
9 years, 5 months
[Bug 1093274] New: CVE-2014-0363 smack: incorrect X.509 validation [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1093274
Bug ID: 1093274
Summary: CVE-2014-0363 smack: incorrect X.509 validation
[fedora-all]
Product: Fedora
Version: 20
Component: smack
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: puntogil(a)libero.it
Reporter: mmcallis(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Blocks: 1093273 (CVE-2014-0363)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1093273
[Bug 1093273] CVE-2014-0363 smack: incorrect X.509 validation
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=7My14W5YkM&a=cc_unsubscribe
9 years, 5 months