[Bug 719628] New: Please build jtidy for EPEL 6
by Red Hat Bugzilla
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug.
Summary: Please build jtidy for EPEL 6
https://bugzilla.redhat.com/show_bug.cgi?id=719628
Summary: Please build jtidy for EPEL 6
Product: Fedora
Version: rawhide
Platform: Unspecified
OS/Version: Unspecified
Status: NEW
Severity: unspecified
Priority: unspecified
Component: jtidy
AssignedTo: SpikeFedora(a)gmail.com
ReportedBy: redhat-bugzilla(a)linuxnetz.de
QAContact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, robert.scheck(a)etes.de,
SpikeFedora(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org
Classification: Fedora
Story Points: ---
Description of problem:
Please build jtidy from Fedora 15 for EPEL 6, because it is required to
build dom4j in EPEL 6.
Version-Release number of selected component (if applicable):
jtidy-1.0-0.10.20100930svn1125.fc15
Additional info:
Please let me know, if you just don't want to be the maintainer for the
jtidy EPEL 6 package...
--
Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.
6 years, 6 months
[Bug 1329272] New: Could not find artifact org.gradle:gradle-base-services:jar:2.8 in mizdebsk-redhat (http://people.redhat.com/~mizdebsk/xmvn/repo/)
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1329272
Bug ID: 1329272
Summary: Could not find artifact
org.gradle:gradle-base-services:jar:2.8 in
mizdebsk-redhat
(http://people.redhat.com/~mizdebsk/xmvn/repo/)
Product: Fedora
Version: rawhide
Component: xmvn
Assignee: mizdebsk(a)redhat.com
Reporter: matthias(a)mailaender.name
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
Description of problem:
I tried to build xmvn locally on openSUSE Tumbleweed.
Version-Release number of selected component (if applicable):
xmvn-2.5.0
Steps to Reproduce:
mvn -B clean install
[...]
[INFO] XMvn Connector for Gradle .......................... FAILURE [ 5.718 s]
[...]
[ERROR] Failed to execute goal on project xmvn-connector-gradle: Could not
resolve dependencies for project
org.fedoraproject.xmvn:xmvn-connector-gradle:jar:2.5.0: The following artifacts
could not be resolved: org.gradle:gradle-base-services:jar:2.8,
org.gradle:gradle-base-services-groovy:jar:2.8, org.gradle:gradle-core:jar:2.8,
org.gradle:gradle-dependency-management:jar:2.8,
org.gradle:gradle-resources:jar:2.8: Could not find artifact
org.gradle:gradle-base-services:jar:2.8 in mizdebsk-redhat
(http://people.redhat.com/~mizdebsk/xmvn/repo/) -> [Help 1]
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 6 months
[Bug 1413505] New: CVE-2016-6814 groovy18: Apache Groovy: Information disclosure [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1413505
Bug ID: 1413505
Summary: CVE-2016-6814 groovy18: Apache Groovy: Information
disclosure [fedora-all]
Product: Fedora
Version: 25
Component: groovy18
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: puntogil(a)libero.it
Reporter: amaris(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 7 months
[Bug 1397485] New: CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1397485
Bug ID: 1397485
Summary: CVE-2016-8735 tomcat: Remote code execution
vulnerability in JmxRemoteLifecycleListener
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: aileenc(a)redhat.com, alee(a)redhat.com,
aszczucz(a)redhat.com, bbaranow(a)redhat.com,
bdawidow(a)redhat.com, bgollahe(a)redhat.com,
bmaxwell(a)redhat.com, ccoleman(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
csutherl(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com, dosoudil(a)redhat.com,
epp-bugs(a)redhat.com, felias(a)redhat.com,
fnasser(a)redhat.com, gzaronik(a)redhat.com,
hchiorea(a)redhat.com, hfnukal(a)redhat.com,
hhorak(a)redhat.com, ivan.afonichev(a)gmail.com,
jason.greene(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jdoyle(a)redhat.com,
jgoulding(a)redhat.com, jialiu(a)redhat.com,
joelsmith(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jshepherd(a)redhat.com,
kanderso(a)redhat.com, krzysztof.daniel(a)gmail.com,
lgao(a)redhat.com, lmeyer(a)redhat.com,
mbabacek(a)redhat.com, mbaluch(a)redhat.com,
me(a)coolsvap.net, miburman(a)redhat.com,
mizdebsk(a)redhat.com, mmccomas(a)redhat.com,
mnewsome(a)redhat.com, mweiler(a)redhat.com,
myarboro(a)redhat.com, nwallace(a)redhat.com,
ohudlick(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, psakar(a)redhat.com,
pslavice(a)redhat.com, rnetuka(a)redhat.com,
rsvoboda(a)redhat.com, rzima(a)redhat.com,
spinder(a)redhat.com, theute(a)redhat.com,
trick(a)vanstaveren.us, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix
for CVE-2016-3427. Therefore, Tomcat installations using this listener remained
vulnerable to a similar remote code execution vulnerability. This issue has
been rated as important rather than critical due to the small number of
installations using this listener and that it would be highly unusual for the
JMX ports to be accessible to an attacker even when the listener is used.
Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6
Upstream patches:
Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767684
Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767676
Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767656
Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767646
External References:
https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 7 months
[Bug 1378038] New: xmvn-install: Manifest injection skipped
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1378038
Bug ID: 1378038
Summary: xmvn-install: Manifest injection skipped
Product: Fedora
Version: rawhide
Component: xmvn
Assignee: mizdebsk(a)redhat.com
Reporter: msimacek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
Description of problem:
For some JAR files, manifest injection gets skipped, even though they have a
manifest.
From debug log:
[TRACE] Manifest injection skipped: no pre-existing manifest found to update
Version-Release number of selected component (if applicable):
xmvn-install-2.5.0-15.fc26.noarch
How reproducible:
always
Steps to Reproduce:
1. rebuild ecj package
Actual results:
Manifest injection doesn't happen.
Expected results:
Manifest is injected into all JARs.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 7 months
[Bug 1409838] New: CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1409838
Bug ID: 1409838
Summary: CVE-2016-9879 Spring Security: Improper handling of
path parameters allows bypassing the security
constraint
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
bmcclain(a)redhat.com, chazlett(a)redhat.com,
dblechte(a)redhat.com, dmcphers(a)redhat.com,
eedri(a)redhat.com, gklein(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
lsurette(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mmccomas(a)redhat.com,
puntogil(a)libero.it, rbalakri(a)redhat.com,
Rhev-m-bugs(a)redhat.com, sbonazzo(a)redhat.com,
sherold(a)redhat.com, srevivo(a)redhat.com,
tiwillia(a)redhat.com, ydary(a)redhat.com,
ykaul(a)redhat.com
Spring Security does not consider URL path parameters when processing security
constraints. By adding a URL path parameter with an encoded "/" to a request,
an attacker may be able to bypass a security constraint. The root cause of this
issue is a lack of clarity regarding the handling of path parameters in the
Servlet Specification (see below). Some Servlet containers include path
parameters in the value returned for getPathInfo() and some do not. Spring
Security uses the value returned by getPathInfo() as part of the process of
mapping requests to security constraints. The unexpected presence of path
parameters can cause a constraint to be bypassed.
Users of Apache Tomcat (all current versions) are not affected by this
vulnerability since Tomcat follows the guidance previously provided by the
Servlet Expert group and strips path parameters from the value returned by
getContextPath(), getServletPath() and getPathInfo().
Users of other Servlet containers based on Apache Tomcat may or may not be
affected depending on whether or not the handling of path parameters has been
modified.
Users of IBM WebSphere Application Server 8.5.x are known to be affected.
Users of other containers that implement the Servlet specification may be
affected.
Mitigation:
Use a Servlet container known not to include path parameters in the return
values for getServletPath() and getPathInfo()
Upstream bug:
https://github.com/spring-projects/spring-security/issues/4169
External Reference:
https://pivotal.io/security/cve-2016-9879
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 7 months