[Bug 1205637] New: CVE-2015-1813 CVE-2015-1812 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177) [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1205637
Bug ID: 1205637
Summary: CVE-2015-1813 CVE-2015-1812 jenkins: Reflective XSS
vulnerability (SECURITY-171, SECURITY-177)
[fedora-all]
Product: Fedora
Version: 21
Component: jenkins
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: msrb(a)redhat.com
Reporter: vkaigoro(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
msrb(a)redhat.com
Blocks: 1205615 (CVE-2015-1812,CVE-2015-1813)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
[Bug 1205615] CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS
vulnerability (SECURITY-171, SECURITY-177)
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=l35ew8mFig&a=cc_unsubscribe
9 years, 1 month
[javapackages] Fix build script
by Mikolaj Izdebski
commit ac611c55809563a85dad5c1a1760c684719d2fb9
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Apr 21 13:17:53 2015 +0200
Fix build script
build | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
---
diff --git a/build b/build
index 70bbc49..2e0292c 100755
--- a/build
+++ b/build
@@ -84,7 +84,6 @@ expand bin/xmvn-builddep
expand etc/java.conf
expand macros.d/macros.jpackage
expand macros.d/macros.fjava
-expand macros.d/macros.xmvn
expand java-utils/java-functions
expand depgenerators/maven.req
expand depgenerators/maven.prov
9 years, 1 month
[javapackages] Fix install script
by Mikolaj Izdebski
commit 2ff3c742174429192b977cf6b084769ad1dd5903
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Apr 21 13:06:39 2015 +0200
Fix install script
install | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
---
diff --git a/install b/install
index 53ed9b9..2db5685 100755
--- a/install
+++ b/install
@@ -171,7 +171,6 @@ inst_config etc/javapackages-config.json "${javaconfdir}"
exec >files-local
inst_data target/macros.fjava "${rpmconfigdir}/macros.d"
-inst_data target/macros.xmvn "${rpmconfigdir}/macros.d"
inst_data java-utils/mvn_alias.py "${javadir}-utils"
inst_data java-utils/mvn_artifact.py "${javadir}-utils"
9 years, 1 month
[javapackages] Set xmvn.resolver.requestArtifactCmd property in mvn_build.py
by Mikolaj Izdebski
commit 9d459a1da64b083682665c40aea2c73956c6705a
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Apr 21 12:58:00 2015 +0200
Set xmvn.resolver.requestArtifactCmd property in mvn_build.py
java-utils/mvn_build.py | 7 +++++++
1 files changed, 7 insertions(+), 0 deletions(-)
---
diff --git a/java-utils/mvn_build.py b/java-utils/mvn_build.py
index 6e64478..eb40aa0 100644
--- a/java-utils/mvn_build.py
+++ b/java-utils/mvn_build.py
@@ -40,6 +40,7 @@ import sys
from javapackages.maven.artifact import Artifact
from javapackages.xmvn.xmvn_config import XMvnConfig
from javapackages.common.util import args_to_unicode
+from javapackages.common.mock import socket_path as mock_socket
def goal_callback(option, opt_str, value, parser):
@@ -118,6 +119,12 @@ if __name__ == "__main__":
xc.add_custom_option("buildSettings/skipTests", "true")
base_goal = "package"
+ if mock_socket and os.path.exists(mock_socket):
+ interpreter = sys.executable
+ java_utils = os.path.dirname(os.path.abspath(__file__))
+ cmd = "%s %s/request-artifact.py" % (interpreter, java_utils)
+ mvn_args.append("-Dxmvn.resolver.requestArtifactCmd='%s'" % cmd)
+
mvn_args.extend(args)
if options.goal_before:
9 years, 1 month
[javapackages] Revert "Add support macros for pm_request mock plugin"
by Mikolaj Izdebski
commit 92a50ba69562d9cb3b6fc406d6aedd791596757b
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Apr 21 12:22:24 2015 +0200
Revert "Add support macros for pm_request mock plugin"
This reverts commit 4cd20c1b7b26ffcba80e2929dba8497ea6fbf529.
macros.d/macros.fjava | 14 ++++----------
1 files changed, 4 insertions(+), 10 deletions(-)
---
diff --git a/macros.d/macros.fjava b/macros.d/macros.fjava
index 58fc05e..73f51df 100644
--- a/macros.d/macros.fjava
+++ b/macros.d/macros.fjava
@@ -31,12 +31,6 @@
# Mikolaj Izdebski <mizdebsk(a)redhat.com>
-# Support code for pm_request mock plugin
-%{lua: if posix.access(posix.getenv("PM_REQUEST_SOCKET")) then
- rpm.define("_javapackages_xmvn_env XMVN_REQUEST_ARTIFACT_CMD='%{pyinterpreter} %{javadir}-utils/mvn_build.py'")
-end}
-
-
# %mvn_package - assign Maven artifact(s) to a subpackage
#
# Usage: %mvn_package [gId]:[aId[:ver]] <subpackage name>
@@ -125,7 +119,7 @@ end}
#
# Usage: %mvn_artifact <pom> [<artifact-file>]
#
-%mvn_artifact %{?_javapackages_xmvn_env} %{pyinterpreter} %{javadir}-utils/mvn_artifact.py
+%mvn_artifact %{pyinterpreter} %{javadir}-utils/mvn_artifact.py
# %mvn_build - build Maven project
@@ -137,7 +131,7 @@ end}
#
# For summary of accepted options execute `mvn-build --help` command.
#
-%mvn_build %{?_javapackages_xmvn_env} %{pyinterpreter} %{javadir}-utils/mvn_build.py %{?xmvn_bootstrap: -b} %{?_without_javadoc: -j $(> .mfiles-javadoc)}%{?_without_tests: -f}
+%mvn_build %{pyinterpreter} %{javadir}-utils/mvn_build.py %{?xmvn_bootstrap: -b} %{?_without_javadoc: -j $(> .mfiles-javadoc)}%{?_without_tests: -f}
# %mvn_install - install Maven project
@@ -148,7 +142,7 @@ end}
# buildroot. It is intended to be placed in %install section of spec file.
#
%mvn_install(J:X) \
-%{?_javapackages_xmvn_env} xmvn-install %{?-X} -R .xmvn-reactor -n %{?scl:%{pkg_name}}%{!?scl:%{name}} -d "%{buildroot}" \
+xmvn-install %{?-X} -R .xmvn-reactor -n %{?scl:%{pkg_name}}%{!?scl:%{name}} -d "%{buildroot}" \
%{-J*:jdir="%{-J*}"}%{!-J*:jdir=target/site/apidocs; [ -d .xmvn/apidocs ] && jdir=.xmvn/apidocs} \
if [ -d "${jdir}" ]; then \
install -dm755 %{buildroot}%{_javadocdir}/%{?scl:%{pkg_name}}%{!?scl:%{name}} \
@@ -193,7 +187,7 @@ for _dir in %{_jnidir} %{_javadir}; do \
_jpath="$_jbase/$_jarpart" \
fi \
done \
-%{?_javapackages_xmvn_env} %{pyinterpreter} %{javadir}-utils/maven_depmap.py %{-a} %{-v*:-r %{-v*}} \\\
+%{pyinterpreter} %{javadir}-utils/maven_depmap.py %{-a} %{-v*:-r %{-v*}} \\\
-n "%{?scl}" \\\
--pom-base %{buildroot}%{_mavenpomdir} \\\
--jar-base "$_jbase" \\\
9 years, 1 month
[javapackages] Add support macros for pm_request mock plugin
by Mikolaj Izdebski
commit 4cd20c1b7b26ffcba80e2929dba8497ea6fbf529
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Apr 21 12:03:41 2015 +0200
Add support macros for pm_request mock plugin
macros.d/macros.fjava | 14 ++++++++++----
1 files changed, 10 insertions(+), 4 deletions(-)
---
diff --git a/macros.d/macros.fjava b/macros.d/macros.fjava
index 73f51df..58fc05e 100644
--- a/macros.d/macros.fjava
+++ b/macros.d/macros.fjava
@@ -31,6 +31,12 @@
# Mikolaj Izdebski <mizdebsk(a)redhat.com>
+# Support code for pm_request mock plugin
+%{lua: if posix.access(posix.getenv("PM_REQUEST_SOCKET")) then
+ rpm.define("_javapackages_xmvn_env XMVN_REQUEST_ARTIFACT_CMD='%{pyinterpreter} %{javadir}-utils/mvn_build.py'")
+end}
+
+
# %mvn_package - assign Maven artifact(s) to a subpackage
#
# Usage: %mvn_package [gId]:[aId[:ver]] <subpackage name>
@@ -119,7 +125,7 @@
#
# Usage: %mvn_artifact <pom> [<artifact-file>]
#
-%mvn_artifact %{pyinterpreter} %{javadir}-utils/mvn_artifact.py
+%mvn_artifact %{?_javapackages_xmvn_env} %{pyinterpreter} %{javadir}-utils/mvn_artifact.py
# %mvn_build - build Maven project
@@ -131,7 +137,7 @@
#
# For summary of accepted options execute `mvn-build --help` command.
#
-%mvn_build %{pyinterpreter} %{javadir}-utils/mvn_build.py %{?xmvn_bootstrap: -b} %{?_without_javadoc: -j $(> .mfiles-javadoc)}%{?_without_tests: -f}
+%mvn_build %{?_javapackages_xmvn_env} %{pyinterpreter} %{javadir}-utils/mvn_build.py %{?xmvn_bootstrap: -b} %{?_without_javadoc: -j $(> .mfiles-javadoc)}%{?_without_tests: -f}
# %mvn_install - install Maven project
@@ -142,7 +148,7 @@
# buildroot. It is intended to be placed in %install section of spec file.
#
%mvn_install(J:X) \
-xmvn-install %{?-X} -R .xmvn-reactor -n %{?scl:%{pkg_name}}%{!?scl:%{name}} -d "%{buildroot}" \
+%{?_javapackages_xmvn_env} xmvn-install %{?-X} -R .xmvn-reactor -n %{?scl:%{pkg_name}}%{!?scl:%{name}} -d "%{buildroot}" \
%{-J*:jdir="%{-J*}"}%{!-J*:jdir=target/site/apidocs; [ -d .xmvn/apidocs ] && jdir=.xmvn/apidocs} \
if [ -d "${jdir}" ]; then \
install -dm755 %{buildroot}%{_javadocdir}/%{?scl:%{pkg_name}}%{!?scl:%{name}} \
@@ -187,7 +193,7 @@ for _dir in %{_jnidir} %{_javadir}; do \
_jpath="$_jbase/$_jarpart" \
fi \
done \
-%{pyinterpreter} %{javadir}-utils/maven_depmap.py %{-a} %{-v*:-r %{-v*}} \\\
+%{?_javapackages_xmvn_env} %{pyinterpreter} %{javadir}-utils/maven_depmap.py %{-a} %{-v*:-r %{-v*}} \\\
-n "%{?scl}" \\\
--pom-base %{buildroot}%{_mavenpomdir} \\\
--jar-base "$_jbase" \\\
9 years, 1 month
[javapackages] Merge macros.xmvn into macros.fjava
by Mikolaj Izdebski
commit b72eb700637a8b3f73db7a77bb6d4a1ba88b579a
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Apr 21 11:37:39 2015 +0200
Merge macros.xmvn into macros.fjava
macros.d/macros.fjava | 123 +++++++++++++++++++++++++++++++++++++++-
macros.d/macros.xmvn | 151 -------------------------------------------------
2 files changed, 122 insertions(+), 152 deletions(-)
---
diff --git a/macros.d/macros.fjava b/macros.d/macros.fjava
index 7aa8446..73f51df 100644
--- a/macros.d/macros.fjava
+++ b/macros.d/macros.fjava
@@ -1,4 +1,4 @@
-# Copyright (c) 2012-2013, Red Hat, Inc
+# Copyright (c) 2012-2015, Red Hat, Inc
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
@@ -31,6 +31,127 @@
# Mikolaj Izdebski <mizdebsk(a)redhat.com>
+# %mvn_package - assign Maven artifact(s) to a subpackage
+#
+# Usage: %mvn_package [gId]:[aId[:ver]] <subpackage name>
+#
+# This macro causes given artifact(s) to be installed in given subpackage.
+#
+# GId, aId and ver can contain wildcards and alternatives, which allows
+# multiple artifacts to be matched. If any of gId, aId or ver is omited
+# then any value will match the respective part. In particular a bare :
+# symbol will match any artifact.
+#
+# Subpackage name can contain backreferences in form @n.
+#
+%mvn_package %{pyinterpreter} %{javadir}-utils/mvn_package.py
+
+
+# %mvn_alias - create alias(es) for given Maven artifact(s)
+#
+# Usage: %mvn_alias [gId]:[aId[:ver]] [aliasGId]:[aliasAId[:aliasVer]] [...]
+#
+# This macro adds one or more aliases for specified artifacts. Aliases are
+# additional groupId, artifactId and version triples under which artifacts
+# can be found. After resulting package is installed any attempts to
+# resolve any of aliases will result in resolving the original artifact.
+#
+# GId, aId and ver can contain wildcards and alternatives, which allows
+# multiple artifacts to be matched. If any of gId, aId or ver is omited
+# then any value will match the respective part. In particular a bare :
+# symbol will match any artifact.
+#
+# AliasGId, aliasAId and aliasVer can contain backreferences in form @n,
+# which can refer only to respective parts.
+#
+%mvn_alias %{pyinterpreter} %{javadir}-utils/mvn_alias.py
+
+
+# %mvn_file - specify file name(s) for Maven artifact(s)
+#
+# Usage: %mvn_file [gId]:[aId[:ver]] <file1> [file2 ...]
+#
+# GId, aId and ver can contain wildcards and alternatives, which allows
+# multiple artifacts to be matched. If any of gId, aId or ver is omited
+# then any value will match the respective part. In particular a bare :
+# symbol will match any artifact.
+#
+# File names can contain backreferences in form @n. If multiple names
+# are given then the first one will be primary name of the artifact and
+# additional names will be symbolic links pointing to the primary file.
+#
+%mvn_file %{pyinterpreter} %{javadir}-utils/mvn_file.py
+
+# %mvn_compat_version - specify file name(s) for Maven artifact(s)
+#
+# Usage: %mvn_compat_version [gId]:[aId[:ver]] <version1> [version2 ...]
+#
+# GId, aId and ver can contain wildcards and alternatives, which allows
+# multiple artifacts to be matched. If any of gId, aId or ver is omited
+# then any value will match the respective part. In particular a bare :
+# symbol will match any artifact.
+#
+# Versions can contain backreferences in form @n. If multiple versions are
+# given then the first one will be primary version of the artifact and
+# additional versions will be symbolic links pointing to the primary
+# version.
+#
+%mvn_compat_version %{pyinterpreter} %{javadir}-utils/mvn_compat_version.py
+
+
+# %mvn_config - set XMvn configuration option
+#
+# Usage: %mvn_config <option> <value>
+#
+# This macro sets value of specified XMvn configuration option.
+#
+# Option is a sequence of slash-delimited XML node names that identify
+# XMvn configuration option, as in XMvn configuration reference; for
+# example: buildSettings/compilerSource.
+#
+# For information about available configuration options, see XMvn
+# configuration reference, available on XMvn website.
+#
+%mvn_config %{pyinterpreter} %{javadir}-utils/mvn_config.py
+
+
+# %mvn_artifact - add Maven artifact to be installed
+#
+# Usage: %mvn_artifact <pom> [<artifact-file>]
+#
+%mvn_artifact %{pyinterpreter} %{javadir}-utils/mvn_artifact.py
+
+
+# %mvn_build - build Maven project
+#
+# Usage: %mvn_build [options]
+#
+# This macro causes Maven project to be built (usually compiled and
+# packaged). It is intended to be placed in %build section of spec file.
+#
+# For summary of accepted options execute `mvn-build --help` command.
+#
+%mvn_build %{pyinterpreter} %{javadir}-utils/mvn_build.py %{?xmvn_bootstrap: -b} %{?_without_javadoc: -j $(> .mfiles-javadoc)}%{?_without_tests: -f}
+
+
+# %mvn_install - install Maven project
+#
+# Usage: %mvn_install
+#
+# This macro causes previously built Maven project to be installed into
+# buildroot. It is intended to be placed in %install section of spec file.
+#
+%mvn_install(J:X) \
+xmvn-install %{?-X} -R .xmvn-reactor -n %{?scl:%{pkg_name}}%{!?scl:%{name}} -d "%{buildroot}" \
+%{-J*:jdir="%{-J*}"}%{!-J*:jdir=target/site/apidocs; [ -d .xmvn/apidocs ] && jdir=.xmvn/apidocs} \
+if [ -d "${jdir}" ]; then \
+ install -dm755 %{buildroot}%{_javadocdir}/%{?scl:%{pkg_name}}%{!?scl:%{name}} \
+ cp -pr "${jdir}"/* %{buildroot}%{_javadocdir}/%{?scl:%{pkg_name}}%{!?scl:%{name}} \
+ echo '%{_javadocdir}/%{?scl:%{pkg_name}}%{!?scl:%{name}}' >>.mfiles-javadoc \
+fi \
+%{nil}
+
+
#==============================================================================
#
# add_maven_depmap is simplified version of jpackage-style add_to_maven_depmap
9 years, 1 month