[Bug 1205616] New: CVE-2015-1814 jenkins: forced API token change (SECURITY-180)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1205616
Bug ID: 1205616
Summary: CVE-2015-1814 jenkins: forced API token change
(SECURITY-180)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com
The part of Jenkins that issues a new API token was not adequately protected
against anonymous attackers. This allows an attacker to escalate privileges on
Jenkins
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=mpKhqf4MCU&a=cc_unsubscribe
8 years, 3 months
[Bug 1205615] New: CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1205615
Bug ID: 1205615
Summary: CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS
vulnerability (SECURITY-171, SECURITY-177)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: vkaigoro(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jdetiber(a)redhat.com, jialiu(a)redhat.com,
jkeck(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mmccomas(a)redhat.com,
msrb(a)redhat.com
An attacker without any access to Jenkins can navigate the user to a carefully
crafted URL and have the user execute unintended actions. This vulnerability
can be used to attack Jenkins inside firewalls from outside so long as the
location of Jenkins is known to the attacker.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=aUngdTWJZ8&a=cc_unsubscribe
8 years, 3 months
[javapackages] Remove obsolete config from pylintrc
by Mikolaj Izdebski
commit 43cdcf84a46997e7010ee85398cdee935a1d5034
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Jan 26 11:10:11 2016 +0100
Remove obsolete config from pylintrc
pylintrc | 6 ------
1 files changed, 0 insertions(+), 6 deletions(-)
---
diff --git a/pylintrc b/pylintrc
index 0c7ef1e..ddf1a7d 100644
--- a/pylintrc
+++ b/pylintrc
@@ -21,12 +21,6 @@ persistent=yes
# usually to register additional checkers.
load-plugins=
-# DEPRECATED
-include-ids=no
-
-# DEPRECATED
-symbols=no
-
[MESSAGES CONTROL]
8 years, 3 months
[javapackages] Clean obsolete TODO items
by Mikolaj Izdebski
commit ca3ed632123489361cf353363b3d4220c4b11875
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Jan 26 11:09:48 2016 +0100
Clean obsolete TODO items
TODO | 11 -----------
1 files changed, 0 insertions(+), 11 deletions(-)
---
diff --git a/TODO b/TODO
index c5f4870..68f1371 100644
--- a/TODO
+++ b/TODO
@@ -3,11 +3,6 @@
* TASKS
-** Remove deprecated code when it's no longer used
- git grep -i @''deprecated
-
-** Remove all references to "depmap" from documentation
-
** Include ivy-local in package diagram
** Add more tests for new metadata
@@ -16,8 +11,6 @@
** Move POM related classes from artifact.py to separate (sub)module/library(?)
-** Update documentation - it still refers to %{_mavendepmapfragdir} and so on
-
** changes around OSGi prov/req generators need some tests
** implement recommends and suggests generators
@@ -40,9 +33,5 @@
https://bugzilla.redhat.com/buglist.cgi?product=Fedora&component=javapack...
-** $ python3 mvn_macros_test.py
- test_rpmbuild.py:94: ResourceWarning: unclosed file <_io.TextIOWrapper name='tmpout' mode='w' encoding='UTF-8'>
- outfile = open("tmpout", 'r+')
-
* FEATURES
8 years, 3 months
[javapackages] Remove obsolete outline.txt
by Mikolaj Izdebski
commit 5078838ef9605f4a8c5a62db31bd068ffd34f5e5
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Jan 26 11:09:13 2016 +0100
Remove obsolete outline.txt
doc/outline.txt | 64 -------------------------------------------------------
1 files changed, 0 insertions(+), 64 deletions(-)
8 years, 3 months
[javapackages] Add Python 3.5 to travis.yml
by Mikolaj Izdebski
commit 06cbe520a82cf1bbdbdc9a4ed4d85dfeaab4101c
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Jan 26 11:08:53 2016 +0100
Add Python 3.5 to travis.yml
.travis.yml | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
---
diff --git a/.travis.yml b/.travis.yml
index 57d0c4c..3228285 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -4,6 +4,7 @@ python:
- 2.7
- 3.3
- 3.4
+ - 3.5
install:
- sudo apt-get update
- sudo apt-get install rpm
8 years, 3 months
[javapackages] Clean work-in-progress comments in HOWTO
by Mikolaj Izdebski
commit fb983e9c27bfb56781e1fc06813fdd5e6a3f12a8
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Tue Jan 26 11:08:36 2016 +0100
Clean work-in-progress comments in HOWTO
doc/core_java_packages.txt | 22 ++++++++--------------
doc/fedora_java_packaging_specifics.txt | 3 ---
2 files changed, 8 insertions(+), 17 deletions(-)
---
diff --git a/doc/core_java_packages.txt b/doc/core_java_packages.txt
index 2baf4b2..aa98ca3 100644
--- a/doc/core_java_packages.txt
+++ b/doc/core_java_packages.txt
@@ -1,6 +1,3 @@
-WORK IN PROGRESS
-mizdebsk, 25 Oct 2013
-
==== JVM
Fedora allows multiple Java Virtual Machines (JVMs) to be packaged
@@ -64,11 +61,16 @@ Java Packages Tools are packaged as severas binary RPM packages
various macros and utlilty tools. `maven-local` is usually
declared as build dependency of Maven packages.
+*`gradle-local`*::
+
+ Similairly to `maven-local`, this package provides an environment
+ required to build Java packages using Gradle as a build tool.
+
*`ivy-local`*::
- Analogously to `maven-local`, this package provides an environment
- required to build Java packages using Apache Ivy as dependency
- manager.
+ Analogously to `maven-local` and `gradle-local`, this package
+ provides an environment required to build Java packages using
+ Apache Ivy as dependency manager.
*`javapackages-local`*::
@@ -80,11 +82,3 @@ Java Packages Tools are packaged as severas binary RPM packages
Package owning basic Java directories and providing runtime
support for Java packages. The great majority of Java packages
depend on `javapackages-tools`.
-
-
-TODO
-
-* Ant
-** extra tasks and /etc/ant.d
-* Maven
-** XMvn
diff --git a/doc/fedora_java_packaging_specifics.txt b/doc/fedora_java_packaging_specifics.txt
index bde11e2..8039ba6 100644
--- a/doc/fedora_java_packaging_specifics.txt
+++ b/doc/fedora_java_packaging_specifics.txt
@@ -1,6 +1,3 @@
-WORK IN PROGRESS
-mizdebsk, 25 Oct 2013
-
=== Directory Layout
include::directory_layout.txt[]
8 years, 3 months
[javapackages] Remove support for version-specific JAR locations
by Mikolaj Izdebski
commit 07f51bd9d236d6a506150e91f5b46e06c5056f89
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Thu Jan 21 13:04:21 2016 +0100
Remove support for version-specific JAR locations
doc/directory_layout.txt | 12 ------------
install | 7 -------
java-utils/java-functions | 37 -------------------------------------
macros.d/macros.jpackage | 17 -----------------
4 files changed, 0 insertions(+), 73 deletions(-)
---
diff --git a/doc/directory_layout.txt b/doc/directory_layout.txt
index 0532539..5bc7824 100644
--- a/doc/directory_layout.txt
+++ b/doc/directory_layout.txt
@@ -68,15 +68,3 @@ short description.
Directory containing Java configuration files. In particular it
contains main Java configuration file -- `java.conf`.
-
-*`%{_javadir}-ext`* -- `/usr/share/java-ext`::
-*`%{_javadir}-`+_x_._y_._z_+* -- `/usr/share/java-`+_x_._y_._z_+::
-*`%{_jnidir}-ext`* -- `/usr/lib/java-ext`::
-*`%{_jnidir}-`+_x_._y_._z_+* -- `/usr/lib/java-`+_x_._y_._z_+::
-
- These directories are rarely used and are retained mostly for
- compatibility with JPackage project. They are meant to contain
- JAR files that depend on particular Java standard version. Note
- that such JARs can (and usually are) placed in `%{_javadir}` or
- `%{_jnidir}`.
-
diff --git a/install b/install
index 66436f7..64cc47f 100755
--- a/install
+++ b/install
@@ -85,9 +85,7 @@ dir "${jvmcommondatadir}"
dir "${jvmcommonsysconfdir}"
dir "${javadir}"
dir "${javadir}-utils"
-dir "${javadir}-ext"
dir "${jnidir}"
-dir "${jnidir}-ext"
dir "${javadocdir}"
dir "${mavenpomdir}"
dir "${datadir}/maven-metadata"
@@ -95,11 +93,6 @@ dir "${rpmconfigdir}"
dir "${rpmconfigdir}/macros.d"
dir "${rpmconfigdir}/fileattrs"
-for ver in 1.5.0 1.6.0 1.7.0 1.8.0; do
- dir "${javadir}-${ver}"
- dir "${jnidir}-${ver}"
-done
-
inst_exec target/abs2rel "${bindir}"
inst_exec target/build-classpath "${bindir}"
inst_exec target/build-classpath-directory "${bindir}"
diff --git a/java-utils/java-functions b/java-utils/java-functions
index b92bf47..0758a18 100644
--- a/java-utils/java-functions
+++ b/java-utils/java-functions
@@ -301,45 +301,8 @@ run()
# Set JVM-related directories
set_jvm_dirs()
{
- local IFS
- local re
- local option
- local version
-
_set_java_home
- # Java standard version of the JVM. -fullversion seems to be lot faster
- # to invoke than -version. Some examples:
- # java full version "1.4.2_04-b05"
- # java full version "J2RE 1.4.1 IBM build cxia321411-20030930"
- # java full version "Blackdown-1.4.1-01"
- # java version "1.5.0"
-
- re='\([[:digit:]]\{1,\}\.[[:digit:]]\{1,\}\(\.[[:digit:]]\{1,\}\)*\)'
- for option in -fullversion -version; do
- # Yuck, "grep -o" would be cleaner, but requires GNU grep >= 2.5.
- # This could be improved/simplified if sed had non-greedy matching.
- version=$("${JAVACMD}" $option 2>&1 | sed -n \
- -e '/\(openjdk\|java\) \(full \)*version "/s/'$re'/<<<\1>>>/' \
- -e '/\(openjdk\|java\) \(full \)*version "/s/.*<<<\([^>]\{1,\}\)>>>.*/\1/p')
- if [ -n "${version}" ]; then
- _log "Determined Java version to be ${version}"
- break
- fi
- done
-
- if [ -z "${version}" ]; then
- echo "$0: Unable to determine Java version"
- return 1
- fi
-
- # Jar repository for this Java standard
- IFS=:
- _javaverdirs=
- for dir in ${_javadirs}; do
- _javaverdirs="${_javaverdirs}${_javaverdirs:+:}${dir}-${version}"
- done
-
return 0
}
diff --git a/macros.d/macros.jpackage b/macros.d/macros.jpackage
index e86f3d7..c7b3b0c 100644
--- a/macros.d/macros.jpackage
+++ b/macros.d/macros.jpackage
@@ -59,28 +59,11 @@
# Directory where arch and version independent jars are installed.
# This has already been integrated in RH macros following our request.
#
-# By extension:
-# %{_javadir}-ext:
-# - version dependent jars
-# %{_javadir}-x.y.z:
-# - jars for Java standard x.y.z (usually symlinks to %{_javadir}-ext)
-# %{_javadir}-utils:
-# - Java-related scripts
-#
-# To simplify things only %{_javadir} is defined.
-#
%_javadir %{_datadir}/java
#
# Directory where arch-specific (JNI) version-independent jars are installed.
#
-# By extension:
-# %{_jnidir}-ext:
-# - version dependent jars
-# %{_jnidir}-x.y.z:
-# - jars for Java standard x.y.z (usually symlinks to %{_jnidir}-ext)
-# To simplify things only %{_jnidir} is defined.
-#
%_jnidir %{_prefix}/lib/java
#
8 years, 3 months
[javapackages] Remove Maven plugin metadata
by Mikolaj Izdebski
commit 05055c5f27f2fae192c1275bd8512c73d84e9eab
Author: Mikolaj Izdebski <mizdebsk(a)redhat.com>
Date: Thu Jan 21 13:00:30 2016 +0100
Remove Maven plugin metadata
install | 3 -
metadata/download_metadata | 38 --
metadata/metadata-org-apache-maven-plugins.xml | 425 ---------------
metadata/metadata-org-codehaus-mojo.xml | 660 ------------------------
4 files changed, 0 insertions(+), 1126 deletions(-)
---
diff --git a/install b/install
index 361c0b0..66436f7 100755
--- a/install
+++ b/install
@@ -188,9 +188,6 @@ exec >files-maven
dir "${m2home}"
-inst_data metadata/metadata-org-apache-maven-plugins.xml "${sysconfdir}/maven"
-inst_data metadata/metadata-org-codehaus-mojo.xml "${sysconfdir}/maven"
-
exec >files-ivy
8 years, 3 months