[Bug 1317520] New: CVE-2016-0734 activemq: Clickjacking in Web Console
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1317520
Bug ID: 1317520
Summary: CVE-2016-0734 activemq: Clickjacking in Web Console
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, agrimm(a)redhat.com,
aileenc(a)redhat.com, ccoleman(a)redhat.com,
chazlett(a)redhat.com, dmcphers(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
ldimaggi(a)redhat.com, lmeyer(a)redhat.com,
mmccomas(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, puntogil(a)libero.it,
rwagner(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com, s(a)shk.io,
tcunning(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com, tkirby(a)redhat.com
It was reported that the web based administration console does not set the
X-Frame-Options header in HTTP responses. This allows the console to be
embedded in a frame or iframe which could then be used to cause a user to
perform an unintended action in the console.
Affected versions: Apache ActiveMQ 5.0.0 - 5.13.1
External Reference:
http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announc...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 10 months
[Bug 1317516] New: CVE-2016-0782 activemq: Cross-site scripting vulnerabilities in web console
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1317516
Bug ID: 1317516
Summary: CVE-2016-0782 activemq: Cross-site scripting
vulnerabilities in web console
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, agrimm(a)redhat.com,
aileenc(a)redhat.com, ccoleman(a)redhat.com,
chazlett(a)redhat.com, dmcphers(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
ldimaggi(a)redhat.com, lmeyer(a)redhat.com,
mmccomas(a)redhat.com, nwallace(a)redhat.com,
pavelp(a)redhat.com, puntogil(a)libero.it,
rwagner(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com, s(a)shk.io,
tcunning(a)redhat.com, tdawson(a)redhat.com,
tiwillia(a)redhat.com, tkirby(a)redhat.com
Several instances of cross-site scripting vulnerabilities were identified to be
present in the web based administration console as well as the ability to
trigger a Java memory dump into an arbitrary folder. The root cause of these
issues are improper user data output validation and incorrect permissions
configured on Jolokia.
Affected versions: ActiveMQ 5.0.0 - 5.13.1
External Reference:
http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announc...
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 10 months
[Bug 1327049] New: Latest maven-archiver update breaks maven-bundle-plugin
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1327049
Bug ID: 1327049
Summary: Latest maven-archiver update breaks
maven-bundle-plugin
Product: Fedora
Version: rawhide
Component: maven-archiver
Assignee: msrb(a)redhat.com
Reporter: sgehwolf(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Description of problem:
It breaks a couple of koshei builds:
https://apps.fedoraproject.org/koschei/package/jline
https://apps.fedoraproject.org/koschei/package/netty
Version-Release number of selected component (if applicable):
maven-archiver-3.0.1-1.fc25
Actual results:
[ERROR] Failed to execute goal
org.apache.felix:maven-bundle-plugin:3.0.1:manifest (default) on project jline:
Execution default of goal org.apache.felix:maven-bundle-plugin:3.0.1:manifest
failed: An API incompatibility was encountered while executing
org.apache.felix:maven-bundle-plugin:3.0.1:manifest:
java.lang.NoSuchMethodError:
org.apache.maven.archiver.MavenArchiver.getManifest(Lorg/apache/maven/project/MavenProject;Lorg/apache/maven/archiver/MavenArchiveConfiguration;)Lorg/codehaus/plexus/archiver/jar/Manifest;
[ERROR] -----------------------------------------------------
[ERROR] realm = plugin>org.apache.felix:maven-bundle-plugin:2.5.4
[ERROR] strategy = org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy
[ERROR] urls[0] =
file:/usr/share/java/maven-plugin-bundle/maven-bundle-plugin.jar
[ERROR] urls[1] =
file:/usr/share/java/maven-reporting-impl/maven-reporting-impl.jar
[ERROR] urls[2] =
file:/usr/share/java/maven-reporting-api/maven-reporting-api.jar
[ERROR] urls[3] =
file:/usr/share/java/maven-shared-utils/maven-shared-utils.jar
[ERROR] urls[4] = file:/usr/share/java/commons-io.jar
[ERROR] urls[5] = file:/usr/share/java/jsr-305.jar
[ERROR] urls[6] = file:/usr/share/java/maven-doxia/doxia-core.jar
[ERROR] urls[7] = file:/usr/share/java/xerces-j2.jar
[ERROR] urls[8] = file:/usr/share/java/xml-commons-apis.jar
[ERROR] urls[9] = file:/usr/share/java/apache-commons-lang.jar
[ERROR] urls[10] = file:/usr/share/java/httpcomponents/httpclient.jar
[ERROR] urls[11] = file:/usr/share/java/commons-codec.jar
[ERROR] urls[12] = file:/usr/share/java/httpcomponents/httpcore.jar
[ERROR] urls[13] = file:/usr/share/java/xmlunit.jar
[ERROR] urls[14] = file:/usr/share/java/commons-validator.jar
[ERROR] urls[15] = file:/usr/share/java/apache-commons-beanutils.jar
[ERROR] urls[16] = file:/usr/share/java/commons-digester.jar
[ERROR] urls[17] = file:/usr/share/java/commons-logging.jar
[ERROR] urls[18] =
file:/usr/share/java/felix-framework/org.apache.felix.framework.jar
[ERROR] urls[19] = file:/usr/share/java/kxml.jar
[ERROR] urls[20] = file:/usr/share/java/xpp3.jar
[ERROR] urls[21] = file:/usr/share/java/maven/maven-builder-support.jar
[ERROR] urls[22] = file:/usr/share/java/guava.jar
[ERROR] urls[23] = file:/usr/share/java/plexus/interpolation.jar
[ERROR] urls[24] = file:/usr/share/java/org.eclipse.sisu.inject.jar
[ERROR] urls[25] =
file:/usr/share/java/plexus-containers/plexus-component-annotations.jar
[ERROR] urls[26] = file:/usr/share/java/felix/org.osgi.core.jar
[ERROR] urls[27] = file:/usr/share/java/aqute-bnd/biz.aQute.bndlib.jar
[ERROR] urls[28] =
file:/usr/lib64/eclipse/plugins/org.eclipse.osgi.services_3.5.0.v20160329-2000.jar
[ERROR] urls[29] =
file:/usr/lib64/eclipse/plugins/org.eclipse.osgi_3.10.102.v20160329-2000.jar
[ERROR] urls[30] = file:/usr/share/java/felix/felix-bundlerepository.jar
[ERROR] urls[31] = file:/usr/share/java/felix/org.apache.felix.utils.jar
[ERROR] urls[32] = file:/usr/share/java/felix/org.osgi.compendium.jar
[ERROR] urls[33] = file:/usr/share/java/glassfish-servlet-api.jar
[ERROR] urls[34] = file:/usr/share/java/felix/org.osgi.foundation.jar
[ERROR] urls[35] = file:/usr/share/java/aether/aether-util.jar
[ERROR] urls[36] = file:/usr/share/java/guice/google-guice-no_aop.jar
[ERROR] urls[37] = file:/usr/share/java/aopalliance.jar
[ERROR] urls[38] = file:/usr/share/java/plexus/plexus-sec-dispatcher.jar
[ERROR] urls[39] = file:/usr/share/java/plexus/plexus-cipher.jar
[ERROR] urls[40] = file:/usr/share/java/apache-commons-lang3.jar
[ERROR] urls[41] = file:/usr/share/java/maven-archiver/maven-archiver.jar
[ERROR] urls[42] = file:/usr/share/java/plexus/archiver.jar
[ERROR] urls[43] = file:/usr/share/java/plexus/io.jar
[ERROR] urls[44] = file:/usr/share/java/commons-compress.jar
[ERROR] urls[45] = file:/usr/lib/java/snappy-java/snappy-java.jar
[ERROR] urls[46] =
file:/usr/share/java/maven-dependency-tree/maven-dependency-tree.jar
[ERROR] urls[47] = file:/usr/share/java/plexus/utils.jar
[ERROR] urls[48] = file:/usr/share/java/plexus/plexus-build-api.jar
[ERROR] urls[49] = file:/usr/share/java/maven-doxia/doxia-sink-api.jar
[ERROR] urls[50] = file:/usr/share/java/maven-doxia/doxia-logging-api.jar
[ERROR] urls[51] =
file:/usr/share/java/maven-doxia-sitetools/doxia-site-renderer.jar
[ERROR] urls[52] =
file:/usr/share/java/maven-doxia-sitetools/doxia-decoration-model.jar
[ERROR] urls[53] = file:/usr/share/java/maven-doxia/doxia-module-xhtml.jar
[ERROR] urls[54] = file:/usr/share/java/maven-doxia/doxia-module-fml.jar
[ERROR] urls[55] = file:/usr/share/java/plexus-i18n/plexus-i18n.jar
[ERROR] urls[56] = file:/usr/share/java/objectweb-asm/asm-commons.jar
[ERROR] urls[57] = file:/usr/share/java/objectweb-asm/asm-tree.jar
[ERROR] urls[58] = file:/usr/share/java/objectweb-asm/asm.jar
[ERROR] urls[59] = file:/usr/share/java/xbean/xbean-reflect.jar
[ERROR] urls[60] = file:/usr/share/java/plexus-velocity/plexus-velocity.jar
[ERROR] urls[61] = file:/usr/share/java/velocity.jar
[ERROR] urls[62] = file:/usr/share/java/apache-commons-collections.jar
[ERROR] urls[63] = file:/usr/share/java/jdom.jar
[ERROR] Number of foreign imports: 1
[ERROR] import: Entry[import from realm ClassRealm[maven.api, parent: null]]
Expected results:
maven-bundle-plugin works as expected.
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 11 months
[Bug 1340876] New: cant find symbol error
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1340876
Bug ID: 1340876
Summary: cant find symbol error
Product: Fedora
Version: rawhide
Component: hppc
Assignee: puntogil(a)libero.it
Reporter: trepik(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Blocks: 1324020
Description of problem:
When building in mock for F23 having hppc as a buidrequires everything goes
well, but for rawhide there are some symbols missing.
Version-Release number of selected component (if applicable):
0.7.1-3.fc24
How reproducible:
Use hppc as a buldrequires in mock and build for rawhide.
Steps to Reproduce:
I can provide further details upon request.
Actual results:
error: cannot find symbol
[javac] import com.carrotsearch.hppc.LongOpenHashSet;
[javac] import com.carrotsearch.hppc.IntObjectOpenHashMap;
[javac] import com.carrotsearch.hppc.LongOpenHashSet;
[javac] import com.carrotsearch.hppc.LongOpenHashSet;
Expected results:
no Error
Additional info:
I'm building cassandra and hppc is it's dependency. I'm rather seeking for a
solution to my problem, than for some kind of fix or package update.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1324020
[Bug 1324020] Review Request: cassandra - OpenSource database Apache
Cassandra
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 11 months
[Bug 1308619] New: CVE-2015-8795 solr: multiple XSS vulnerabilities
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1308619
Bug ID: 1308619
Summary: CVE-2015-8795 solr: multiple XSS vulnerabilities
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
CVE 2015-8795:
Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in
Apache Solr before 5.1 allow remote attackers to inject arbitrary web
script or HTML via crafted fields that are mishandled during the
rendering of the (1) Analysis page, related to
webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related
to webapp/web/js/scripts/schema-browser.js.
https://issues.apache.org/jira/browse/SOLR-7346
CVE 2015-8796:
Cross-site scripting (XSS) vulnerability in
webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr
before 5.3 allows remote attackers to inject arbitrary web script or
HTML via a crafted schema-browse URL.
https://issues.apache.org/jira/browse/SOLR-7920
CVE 2015-8797:
Cross-site scripting (XSS) vulnerability in
webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in
Apache Solr before 5.3.1 allows remote attackers to inject arbitrary
web script or HTML via the entry parameter to a plugins/cache URI.
https://issues.apache.org/jira/browse/SOLR-7949
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 11 months
[Bug 1341146] New: maven-plugin-testing: FTBFS in rawhide
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1341146
Bug ID: 1341146
Summary: maven-plugin-testing: FTBFS in rawhide
Product: Fedora
Version: rawhide
Component: maven-plugin-testing
Assignee: msimacek(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
msrb(a)redhat.com, yyang(a)redhat.com
Description of problem:
Package maven-plugin-testing fails to build from source in rawhide.
There are test failures, which I'm unable to reproduce on my local machine.
Version-Release number of selected component (if applicable):
3.3.0-6.fc24
Steps to Reproduce:
koji build --scratch f25 maven-plugin-testing-3.3.0-6.fc24.src.rpm
Additional info:
This package is tracked by Koschei. See:
https://apps.fedoraproject.org/koschei/package/maven-plugin-testing
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 11 months
[Bug 1341056] New: powermock: FTBFS in rawhide
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1341056
Bug ID: 1341056
Summary: powermock: FTBFS in rawhide
Product: Fedora
Version: rawhide
Component: powermock
Assignee: rkennke(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, msimacek(a)redhat.com,
neugens(a)redhat.com, projects.rg(a)smart.ms,
rkennke(a)redhat.com
Description of problem:
Package powermock fails to build from source in rawhide.
The reason is recent easymock update to version 3.4.
It also fails during runtime due to easymock ABI breakage.
Version-Release number of selected component (if applicable):
1.6.2-3.fc24
Steps to Reproduce:
koji build --scratch f25 powermock-1.6.2-3.fc24.src.rpm
Additional info:
This package is tracked by Koschei. See:
https://apps.fedoraproject.org/koschei/package/powermock
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 11 months
[Bug 1314239] New: powermock-1.6.4 is available
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1314239
Bug ID: 1314239
Summary: powermock-1.6.4 is available
Product: Fedora
Version: rawhide
Component: powermock
Assignee: rkennke(a)redhat.com
Reporter: puntogil(a)libero.it
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, msimacek(a)redhat.com,
neugens(a)redhat.com, projects.rg(a)smart.ms,
rkennke(a)redhat.com
Latest upstream release: 1.6.4
Current version/release in rawhide: 1.6.2-3.fc24
URL: https://github.com/jayway/powermock/tags
Please, consider upgrading
--
You are receiving this mail because:
You are on the CC list for the bug.
7 years, 11 months