[Bug 1308853] New: okhttp: certificate pining bypass [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1308853
Bug ID: 1308853
Summary: okhttp: certificate pining bypass [fedora-all]
Product: Fedora
Version: 23
Component: okhttp
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: gerard(a)ryan.lt
Reporter: anemec(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: gerard(a)ryan.lt,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Blocks: 1308851
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1308851
[Bug 1308851] okhttp: certificate pining bypass
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 3 months
[Bug 1309109] New: Update to okio-1.6.0
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1309109
Bug ID: 1309109
Summary: Update to okio-1.6.0
Product: Fedora
Version: rawhide
Component: okio
Assignee: mizdebsk(a)redhat.com
Reporter: gerard(a)ryan.lt
QA Contact: extras-qa(a)fedoraproject.org
CC: gerard(a)ryan.lt,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com
Created attachment 1127738
--> https://bugzilla.redhat.com/attachment.cgi?id=1127738&action=edit
spec patch to update to 1.6.0
I'm updating okhttp to 2.7.4 for bug #1308853, and it expects okio-1.6.0.
With the attached patch, the package builds locally.
FYI, it adds the new benchmark.jar to the main package though, does that sound
normal/optimal? I guess that module could probably be disabled or subpackaged
as you wish.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 3 months
[Bug 1301952] New: No signature of method groovy.util.surpersupport.NodeChildren.eachParallel()
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1301952
Bug ID: 1301952
Summary: No signature of method
groovy.util.surpersupport.NodeChildren.eachParallel()
Product: Fedora
Version: 23
Component: groovy
Assignee: msrb(a)redhat.com
Reporter: rhopp(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Description of problem:
This is followup of https://issues.jboss.org/browse/JBIDE-21204
I'm getting
groovy.lang.MissingMethodException: No signature of method:
groovy.util.slurpersupport.NodeChildren.eachParallel() is applicable for
argument types:
(GoOfflineScript$_downloadExamplesFromDescriptor_closure3$_closure19) values:
[GoOfflineScript$_downloadExamplesFromDescriptor_closure3$_closure19@4c6daf0]
trying to run this script:
https://github.com/jbosstools/jbosstools-central/blob/be2e5305523ab4bf728...
(The highlighted line is the one which is causing this exception)
Using groovy 2.4.4 (the same version as in RPM package) downloaded from
http://www.groovy-lang.org/ this does not happen.
Version-Release number of selected component (if applicable):
$ dnf info "*groovy*"
Failed to synchronize cache for repo 'Dropbox' from
'http://linux.dropbox.com/fedora/23/': Cannot download repomd.xml: Cannot
download repodata/repomd.xml: All mirrors were tried, disabling.
Last metadata expiration check performed 4 days, 19:43:47 ago on Thu Jan 21
17:41:36 2016.
Installed Packages
Name : groovy
Arch : noarch
Epoch : 0
Version : 2.4.4
Release : 1.fc23
Size : 127 k
Repo : @System
From repo : fedora
Summary : Dynamic language for the Java Platform
URL : http://groovy-lang.org
License : ASL 2.0 and BSD and EPL and Public Domain and CC-BY
Description : Groovy is an agile and dynamic language for the Java Virtual
Machine,
: built upon Java with features inspired by languages like Python,
Ruby and
: Smalltalk. It seamlessly integrates with all existing Java
objects and
: libraries and compiles straight to Java bytecode so you can use
it anywhere
: you can use Java.
Name : groovy-lib
Arch : noarch
Epoch : 0
Version : 2.4.4
Release : 1.fc23
Size : 13 M
Repo : @System
From repo : fedora
Summary : Groovy JAR artifact
URL : http://groovy-lang.org
License : ASL 2.0 and BSD and EPL and Public Domain and CC-BY
Description : This package contains Groovy JAR artifact.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 3 months
[Bug 1299674] New: xmlpull.jar causes java.lang.LinkageError: loader constraint violation: when resolving method "javax.xml.ws.Service"
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1299674
Bug ID: 1299674
Summary: xmlpull.jar causes java.lang.LinkageError: loader
constraint violation: when resolving method
"javax.xml.ws.Service"
Product: Fedora
Version: 23
Component: groovy
Severity: high
Assignee: msrb(a)redhat.com
Reporter: rc556677(a)outlook.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Description of problem:
Running a SOAP client QName is loaded from xmlpull.jar and JVM rt.jar leading
to
Caught: java.lang.LinkageError: loader constraint violation: when resolving
method
"javax.xml.ws.Service.<init>(Ljava/net/URL;Ljavax/xml/namespace/QName;)V" the
class loader (instance of org/codehaus/groovy/tools/RootLoader) of the current
class, org/ejbca/core/protocol/ws/client/gen/EjbcaWSService, and the class
loader (instance of <bootloader>) for the method's defining class,
javax/xml/ws/Service, have different Class objects for the type
javax/xml/namespace/QName used in the signature
java.lang.LinkageError: loader constraint violation: when resolving method
"javax.xml.ws.Service.<init>(Ljava/net/URL;Ljavax/xml/namespace/QName;)V" the
class loader (instance of org/codehaus/groovy/tools/RootLoader) of the current
class, org/ejbca/core/protocol/ws/client/gen/EjbcaWSService, and the class
loader (instance of <bootloader>) for the method's defining class,
javax/xml/ws/Service, have different Class objects for the type
javax/xml/namespace/QName used in the signature
at
org.ejbca.core.protocol.ws.client.gen.EjbcaWSService.<init>(EjbcaWSService.java:37)
at com.example.ejbca.version.run(version.groovy:73)
Version-Release number of selected component (if applicable):
2.4.4
How reproducible:
Always
Steps to Reproduce:
1. Run groovy script using EJBCA SOAP service
Name qname = new QName("http://ws.protocol.core.ejbca.org/", "EjbcaWSService")
def ejbcasvc = new EjbcaWSService(new
URL("https://example.com/ejbca/ejbcaws/ejbcaws?wsdl"), qname)
def ejbcaws = ejbcasvc.getEjbcaWSPort()
logger.info("Connected to EJBCA version: " + Ejbca.getVersion(ejbcaws))
2. The SOAP service is from
https://www.ejbca.org/
3.
Actual results:
Caught: java.lang.LinkageError: loader constraint violation: when resolving
method
"javax.xml.ws.Service.<init>(Ljava/net/URL;Ljavax/xml/namespace/QName;)V" the
class loader (instance of org/codehaus/groovy/tools/RootLoader) of the current
class, org/ejbca/core/protocol/ws/client/gen/EjbcaWSService, and the class
loader (instance of <bootloader>) for the method's defining class,
javax/xml/ws/Service, have different Class objects for the type
javax/xml/namespace/QName used in the signature
java.lang.LinkageError: loader constraint violation: when resolving method
"javax.xml.ws.Service.<init>(Ljava/net/URL;Ljavax/xml/namespace/QName;)V" the
class loader (instance of org/codehaus/groovy/tools/RootLoader) of the current
class, org/ejbca/core/protocol/ws/client/gen/EjbcaWSService, and the class
loader (instance of <bootloader>) for the method's defining class,
javax/xml/ws/Service, have different Class objects for the type
javax/xml/namespace/QName used in the signature
at
org.ejbca.core.protocol.ws.client.gen.EjbcaWSService.<init>(EjbcaWSService.java:37)
Expected results:
[main] INFO ejbca - Connected to EJBCA version: EJBCA 6.3.1.1 Community
(r21429)
Additional info:
Upstream groovy-2.4.5 has xmlpull-1.1.3.1.jar. Not sure why that works but
Fedora groovy doesn't.
Fedora 2.4.4: (with -verbose)
[Loaded javax.xml.namespace.QName from file:/usr/share/groovy/lib/xmlpull.jar]
[Loaded javax.xml.namespace.QName from
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.65-4.b17.fc23.x86_64/jre/lib/rt.jar]
Caught: java.lang.LinkageError: loader constraint violation: when resolving
method
"javax.xml.ws.Service.<init>(Ljava/net/URL;Ljavax/xml/namespace/QName;)V" the
class loader (instance of org/codehaus/groovy/tools/RootLoader) of the current
class, org/ejbca/core/protocol/ws/client/gen/EjbcaWSService, and the class
loader (instance of <bootloader>) for the method's defining class,
javax/xml/ws/Service, have different Class objects for the type
javax/xml/namespace/QName used in the signature
Upstream 2.4.5: (-verbose)
[Loaded javax.xml.namespace.QName from
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.65-4.b17.fc23.x86_64/jre/lib/rt.jar]
[Loaded javax.xml.namespace.QName$1 from
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.65-4.b17.fc23.x86_64/jre/lib/rt.jar]
Why upstream doesn't pull in its own groovy-2.4.5/lib/pull-1.1.3.1.jar and
have the same error?
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 3 months
[Bug 1312524] New: jetty-9.3.8.RC0 is available
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1312524
Bug ID: 1312524
Summary: jetty-9.3.8.RC0 is available
Product: Fedora
Version: rawhide
Component: jetty
Keywords: FutureFeature, Triaged
Assignee: mizdebsk(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
Latest upstream release: 9.3.8.RC0
Current version/release in rawhide: 9.3.7-2.v20160115.fc24
URL: http://repo2.maven.org/maven2/org/eclipse/jetty/jetty-project/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 3 months
[Bug 1312534] New: slf4j-1.7.18 is available
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1312534
Bug ID: 1312534
Summary: slf4j-1.7.18 is available
Product: Fedora
Version: rawhide
Component: slf4j
Keywords: FutureFeature, Triaged
Assignee: mizdebsk(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com
Latest upstream release: 1.7.18
Current version/release in rawhide: 1.7.17-1.fc24
URL: http://www.slf4j.org/download.html
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 3 months
[Bug 1312566] New: nasm-2.12 is available
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1312566
Bug ID: 1312566
Summary: nasm-2.12 is available
Product: Fedora
Version: rawhide
Component: nasm
Keywords: FutureFeature, Triaged
Assignee: mizdebsk(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com
Latest upstream release: 2.12
Current version/release in rawhide: 2.11.08-3.fc24
URL: http://www.nasm.us/pub/nasm/releasebuilds/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 3 months