java-sig-commits September 2015

java-sig-commits@lists.fedoraproject.org

3 participants
202 discussions

[Bug 1205616] New: CVE-2015-1814 jenkins: forced API token change (SECURITY-180)
by Red Hat Bugzilla 26 Jan '16

26 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1205616 Bug ID: 1205616 Summary: CVE-2015-1814 jenkins: forced API token change (SECURITY-180) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com The part of Jenkins that issues a new API token was not adequately protected against anonymous attackers. This allows an attacker to escalate privileges on Jenkins External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=mpKhqf4MCU&a=cc_unsubscribe

1 16

[Bug 1205615] New: CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
by Red Hat Bugzilla 26 Jan '16

26 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1205615 Bug ID: 1205615 Summary: CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls from outside so long as the location of Jenkins is known to the attacker. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=aUngdTWJZ8&a=cc_unsubscribe

1 14

[Bug 1127276] New: CVE-2014-5075 smack: MitM vulnerability
by Red Hat Bugzilla 21 Jan '16

21 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1127276 Bug ID: 1127276 Summary: CVE-2014-5075 smack: MitM vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: brms-jira(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, pavelp(a)redhat.com, puntogil(a)libero.it, tkirby(a)redhat.com, weli(a)redhat.com It was reported [1] that Smack (XMPP client library) is vulnerable to MitM attacks with a crafted SSL certificates. Quote from [1]: ... Details ------- Smack is using Java's `SSLSocket`, which checks the peer certificate using an `X509TrustManager`, but does not perform hostname verification. Therefore, it is possible to redirect the traffic between a Smack-using application and a legitimate XMPP server through the attacker's server, merely by providing a valid certificate for a domain under the attacker's control. In Smack versions 2.2.0 to 3.4.1, a custom `ServerTrustManager` implementation was used, which was supplied with the connection's server name, and performed hostname verification. However, it failed to verify the basicConstraints and nameConstraints of the certificate chain (CVE-2014-0363, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0363) and has been removed in Smack 4.0.0. Applications using Smack 2.2.0 to 3.4.1 with a custom `TrustManager` did not benefit from `ServerTrustManager` and are vulnerable as well, unless their own `TrustManager` implementation explicitly performs hostname verification. ... [1]: http://seclists.org/bugtraq/2014/Aug/29 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=vQuZmnHNAP&a=cc_unsubscribe

1 13

[Bug 1222923] New: CVE-2015-2156 netty: HttpOnly cookie bypass
by Red Hat Bugzilla 21 Jan '16

21 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1222923 Bug ID: 1222923 Summary: CVE-2015-2156 netty: HttpOnly cookie bypass Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: aileenc(a)redhat.com, alazarot(a)redhat.com, asantos(a)redhat.com, aszczucz(a)redhat.com, bdawidow(a)redhat.com, bkearney(a)redhat.com, brms-jira(a)redhat.com, cbillett(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, cpelland(a)redhat.com, cperry(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, epp-bugs(a)redhat.com, etirelli(a)redhat.com, felias(a)redhat.com, fnasser(a)redhat.com, gvarsami(a)redhat.com, hchiorea(a)redhat.com, hfnukal(a)redhat.com, huwang(a)redhat.com, jason.greene(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jboss-set(a)redhat.com, jbpapp-maint(a)redhat.com, jcoleman(a)redhat.com, jdg-bugs(a)redhat.com, jerboaa(a)gmail.com, jolee(a)redhat.com, jon.vanalten(a)redhat.com, jpallich(a)redhat.com, katello-bugs(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lpetrovi(a)redhat.com, mbaluch(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com, mweiler(a)redhat.com, mwinkler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, ohadlevy(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, pslavice(a)redhat.com, rhq-maint(a)redhat.com, rrajasek(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, rzhang(a)redhat.com, soa-p-jira(a)post-office.corp.redhat.com, spinder(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com, tomckay(a)redhat.com, ttarrant(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com A flaw was found in the way Netty’s CookieDecoder method validated cookie name and value characters. An attacker could use this flaw to bypass the httpOnly flag on sensitive cookies. Upstream patch: https://github.com/slandelle/netty/commit/800555417e77029dcf8a31d7de44f27b5… External References: https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnly… http://engineering.linkedin.com/security/look-netty%E2%80%99s-recent-securi… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Vfly1r8bG5&a=cc_unsubscribe

1 25

[Bug 1252823] New: Please include plugin script
by Red Hat Bugzilla 19 Jan '16

19 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1252823 Bug ID: 1252823 Summary: Please include plugin script Product: Fedora Version: 22 Component: elasticsearch Assignee: jvanek(a)redhat.com Reporter: pahan(a)hubbitus.info QA Contact: extras-qa(a)fedoraproject.org CC: bobjensen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com, pbrobinson(a)gmail.com, zbyszek(a)in.waw.pl Hello. In repack.sh you delete "elasticsearch elasticsearch.bat elasticsearch-service-mgr.exe elasticsearch-service-x64.exe elasticsearch-service-x86.exe plugin plugin.bat service.bat". I understand what binaries must be stripped. But what with plugin, which is just shell script? I assume it is not sane way install such plugions which is not in rpm form, and it is main reason of excludin, is not? But may we let it on administrator choose when desired plugin is not packaged? Could you please include that script in package as it done in upstream rpm? -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=mqaMrd907k&a=cc_unsubscribe

1 16

[Bug 1239872] New: rachota: FTBFS in rawhide
by Red Hat Bugzilla 13 Jan '16

13 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1239872 Bug ID: 1239872 Summary: rachota: FTBFS in rawhide Product: Fedora Version: rawhide Component: rachota Assignee: sebastien.willmann(a)gmail.com Reporter: dennis(a)ausil.us QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, sebastien.willmann(a)gmail.com Blocks: 1239338 (F23FTBFS) Your package rachota failed to build from source in current rawhide. http://koji.fedoraproject.org/koji/taskinfo?taskID=10148124 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1239338 [Bug 1239338] Fedora 23 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IDZHrZExEC&a=cc_unsubscribe

1 7

[Bug 1208281] New: mockito-1.10.19 is available
by Red Hat Bugzilla 08 Jan '16

08 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1208281 Bug ID: 1208281 Summary: mockito-1.10.19 is available Product: Fedora Version: rawhide Component: mockito Assignee: rkennke(a)redhat.com Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, dpierce(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, omajid(a)redhat.com, rkennke(a)redhat.com Latest upstream release: 1.10.19 Current version/release in Fedora Rawhide: 1.9.0-18.fc23 https://github.com/mockito/mockito/tags NOTE new home: http://mockito.org/ see https://lists.fedoraproject.org/pipermail/meetingminutes/2015-March/001712.… Please, consider upgrading -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6hd5HjVNvT&a=cc_unsubscribe

1 28

[Bug 1079233] New: mockito: update to 1.9.5
by Red Hat Bugzilla 05 Jan '16

05 Jan '16

https://bugzilla.redhat.com/show_bug.cgi?id=1079233 Bug ID: 1079233 Summary: mockito: update to 1.9.5 Product: Fedora Version: rawhide Component: mockito Assignee: rkennke(a)redhat.com Reporter: msrb(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, omajid(a)redhat.com, rkennke(a)redhat.com Created attachment 877167 --> https://bugzilla.redhat.com/attachment.cgi?id=877167&action=edit update to 1.9.5 Description of problem: Upstream version 1.9.5 is available. Rawhide currently contains version 1.9.0. Attached patch was created by Michael Simacek (see #1040350). -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=dvsIbd2J0V&a=cc_unsubscribe

1 7

[Bug 1195244] New: Mis-configured logging mutes log messages
by Red Hat Bugzilla 21 Dec '15

21 Dec '15

https://bugzilla.redhat.com/show_bug.cgi?id=1195244 Bug ID: 1195244 Summary: Mis-configured logging mutes log messages Product: Fedora Version: 22 Component: javapackages-tools Assignee: mizdebsk(a)redhat.com Reporter: leamas.alec(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Created attachment 994371 --> https://bugzilla.redhat.com/attachment.cgi?id=994371&action=edit Test case provoking bug with non-readable metadata. Description of problem: Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. Install DecodeIrCaller from https://copr.fedoraproject.org/coprs/leamas/harctoolbox/ 2. For the example, create a bug: $ sudo chmod 600 /usr/share/maven-metadata/DecodeIrCaller.xml 3.Run attached maven.req. It is a patched version of the thing run by rpmbuild $ ./maven.req 4. Watch in output Processing files: IrpMaster-1.0.2-1.fc21.noarch No handlers could be found for logger "pyxb.binding.basis" No handlers could be found for logger "pyxb.binding.basis" The messages stems from the XML parsing in javapackages/metadata/pyxbmetadata.py around line 59. Obviously, they are not really helpful, loggers should be configure Actual results: Useless messages Expected results: Good messages. Additional info: Same thing is likely to happen for any maven-driver spec given a non-readable metadata dependency. And there are other things which might got wrong, needing configured logger I guess. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AcTChb0Kzb&a=cc_unsubscribe

1 15

[Bug 1226445] New: Missing ability to install plguins
by Red Hat Bugzilla 16 Dec '15

16 Dec '15

https://bugzilla.redhat.com/show_bug.cgi?id=1226445 Bug ID: 1226445 Summary: Missing ability to install plguins Product: Fedora Version: 22 Component: elasticsearch Assignee: jvanek(a)redhat.com Reporter: jimmyjones2(a)gmx.co.uk QA Contact: extras-qa(a)fedoraproject.org CC: bkabrda(a)redhat.com, bobjensen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com, pbrobinson(a)gmail.com, zbyszek(a)in.waw.pl Normally with Elasticsearch you can run bin/plugin to install Marvel, KOPF etc. However this doesn't seem possible in the Fedora packaging of Elasticsearch. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=7Kh9YkfyUS&a=cc_unsubscribe

1 4

← Newer
1
...
6
7
8
9
10
11
12
...
21
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits September 2015