java-sig-commits October 2017

java-sig-commits@lists.fedoraproject.org

1 participants
243 discussions

[Bug 1508123] New: CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
by bugzilla＠redhat.com 04 Dec '18

04 Dec '18

https://bugzilla.redhat.com/show_bug.cgi?id=1508123 Bug ID: 1508123 Summary: CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: abhgupta(a)redhat.com, bmcclain(a)redhat.com, dbhole(a)redhat.com, dblechte(a)redhat.com, dwalluck(a)redhat.com, eedri(a)redhat.com, hhorak(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jorton(a)redhat.com, krzysztof.daniel(a)gmail.com, kseifried(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, puntogil(a)libero.it, sbonazzo(a)redhat.com, sherold(a)redhat.com, sochotni(a)redhat.com, tiwillia(a)redhat.com, ykaul(a)redhat.com, ylavi(a)redhat.com The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element. References: http://www.openwall.com/lists/oss-security/2016/07/12/5 https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html -- You are receiving this mail because: You are on the CC list for the bug.

1 34

[Bug 1372120] New: CVE-2016-6346 RESTEasy: Abuse of GZIPInterceptor in RESTEasy can lead to denial of service attack
by Red Hat Bugzilla 03 Dec '18

03 Dec '18

https://bugzilla.redhat.com/show_bug.cgi?id=1372120 Bug ID: 1372120 Summary: CVE-2016-6346 RESTEasy: Abuse of GZIPInterceptor in RESTEasy can lead to denial of service attack Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: jshepherd(a)redhat.com CC: aileenc(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, aszczucz(a)redhat.com, bazulay(a)redhat.com, bbaranow(a)redhat.com, bdawidow(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmcclain(a)redhat.com, cbillett(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dblechte(a)redhat.com, dosoudil(a)redhat.com, eedri(a)redhat.com, epp-bugs(a)redhat.com, etirelli(a)redhat.com, felias(a)redhat.com, fnasser(a)redhat.com, gklein(a)redhat.com, gvarsami(a)redhat.com, hchiorea(a)redhat.com, hfnukal(a)redhat.com, huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jboss-set(a)redhat.com, jbpapp-maint(a)redhat.com, jcoleman(a)redhat.com, jdg-bugs(a)redhat.com, jmatthew(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, jshepherd(a)redhat.com, katello-bugs(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lpetrovi(a)redhat.com, lsurette(a)redhat.com, mbaluch(a)redhat.com, mgoldboi(a)redhat.com, mgoldman(a)redhat.com, miburman(a)redhat.com, michal.skrivanek(a)redhat.com, mmccune(a)redhat.com, mweiler(a)redhat.com, mwinkler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, ohadlevy(a)redhat.com, oourfali(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, pkliczew(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, puntogil(a)libero.it, rcernich(a)redhat.com, Rhev-m-bugs(a)redhat.com, rnetuka(a)redhat.com, rrajasek(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, rzhang(a)redhat.com, satellite6-bugs(a)redhat.com, sherold(a)redhat.com, soa-p-jira(a)post-office.corp.redhat.com, spinder(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, tomckay(a)redhat.com, tsanders(a)redhat.com, ttarrant(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com, ydary(a)redhat.com, ykaul(a)redhat.com It was found that GZIPInterceptor is enabled when not necessarily required in RESTEasy. An attacker could use this flaw to launch a Denial of Service attack. -- You are receiving this mail because: You are on the CC list for the bug.

2 43

[Bug 1448498] New: apache-sshd-1.4.0 is available
by bugzilla＠redhat.com 01 Dec '18

01 Dec '18

https://bugzilla.redhat.com/show_bug.cgi?id=1448498 Bug ID: 1448498 Summary: apache-sshd-1.4.0 is available Product: Fedora Version: rawhide Component: apache-sshd Keywords: Rebase Assignee: msrb(a)redhat.com Reporter: sbonazzo(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, msrb(a)redhat.com, puntogil(a)libero.it Latest upstream release: 1.4.0 Current version/release in rawhide: 0.14.0-5.fc26 URL: www.eu.apache.org/dist/mina/sshd Based on the information from anitya: https://release-monitoring.org/project/15120/ Opened manually since integration with anitya and upstream release monitoring is turned off in https://admin.fedoraproject.org/pkgdb/package/rpms/apache-sshd/ -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1413657] New: Doesnt start
by Red Hat Bugzilla 30 Nov '18

30 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1413657 Bug ID: 1413657 Summary: Doesnt start Product: Fedora Version: 25 Component: elasticsearch Assignee: zbyszek(a)in.waw.pl Reporter: sergiypavlichenko(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: bobjensen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com, pahan(a)hubbitus.info, zbyszek(a)in.waw.pl Description of problem: Version-Release number of selected component (if applicable): elasticsearch-1.7.1-3.fc24.noarch java version "1.8.0_111" Java(TM) SE Runtime Environment (build 1.8.0_111-b14) Java HotSpot(TM) 64-Bit Server VM (build 25.111-b14, mixed mode) How reproducible: Steps to Reproduce: 1. dnf install elasticsearch 2. systemctl start elasticsearch Actual results: elasticsearch.service - ElasticSearch search engine Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; disabled; vendor preset: disabled) Active: failed (Result: exit-code) since Mon 2017-01-16 17:54:09 EET; 38s ago Docs: https://www.elasticsearch.org/guide/en/elasticsearch/guide/current/index.ht… Process: 9679 ExecStart=/usr/libexec/elasticsearch (code=exited, status=1/FAILURE) Main PID: 9679 (code=exited, status=1/FAILURE) Jan 16 17:54:09 localhost.localdomain elasticsearch[9679]: at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:32) Jan 16 17:54:09 localhost.localdomain elasticsearch[9679]: Caused by: java.lang.ClassNotFoundException: com.fasterxml.jackson.databind.JsonMappingException Jan 16 17:54:09 localhost.localdomain elasticsearch[9679]: at java.net.URLClassLoader.findClass(URLClassLoader.java:381) Jan 16 17:54:09 localhost.localdomain elasticsearch[9679]: at java.lang.ClassLoader.loadClass(ClassLoader.java:424) Jan 16 17:54:09 localhost.localdomain elasticsearch[9679]: at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331) Jan 16 17:54:09 localhost.localdomain elasticsearch[9679]: at java.lang.ClassLoader.loadClass(ClassLoader.java:357) Jan 16 17:54:09 localhost.localdomain elasticsearch[9679]: ... 11 more Jan 16 17:54:09 localhost.localdomain systemd[1]: elasticsearch.service: Main process exited, code=exited, status=1/FAILURE Jan 16 17:54:09 localhost.localdomain systemd[1]: elasticsearch.service: Unit entered failed state. Jan 16 17:54:09 localhost.localdomain systemd[1]: elasticsearch.service: Failed with result 'exit-code'. -- You are receiving this mail because: You are on the CC list for the bug.

2 13

[Bug 1500288] New: jpackage utils requires java-1.8.0-openjdk
by bugzilla＠redhat.com 30 Nov '18

30 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1500288 Bug ID: 1500288 Summary: jpackage utils requires java-1.8.0-openjdk Product: Fedora Version: 27 Component: jpackage-utils Assignee: extras-orphan(a)fedoraproject.org Reporter: jvanek(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, msrb(a)redhat.com, sochotni(a)redhat.com Description of problem: jpackage utils requires java-1.8.0-openjdk Version-Release number of selected component (if applicable): f27+ How reproducible: Consider system java settings for f27: https://fedoraproject.org/wiki/Releases/27/ChangeSet#Decouple_system_java_s… Which brought java-1.8.0-openjdk as dependence to jpackage-tools. As side effect - java-1.8.0-openjdk and jpackage-tools are now circular dependences. - java-1.8.0-openjdk-aarch32 now pulls in java-1.8.0-openjdk - that successfully kills usage of java-1.8.0-openjdk-aarch32 in buildroot, as you can not change alternatives Now consider jdk9 in f27: https://fedoraproject.org/wiki/Releases/27/ChangeSet#Java_9 the side kick is same as for jdk8-aarch32. Installation of java-9-openjdk (which rewuires jpackage tools) will pull in java8. It kills jdk9 in buildroot, and making the life of possible jdk9 user very uncomfortable. Actual results: Installation of jdk8-aarch32 or jdk9 is bringing jdk8 as transitional dependence. Expected results: Installation of jdk8-aarch32 or jdk9 will not bring jdk8 as transitional dependence. -- You are receiving this mail because: You are on the CC list for the bug.

1 23

[Bug 1439284] New: Jenkins is build with dom4j 1.6.1-27 but 2.0.0-1 is installed
by bugzilla＠redhat.com 30 Nov '18

30 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1439284 Bug ID: 1439284 Summary: Jenkins is build with dom4j 1.6.1-27 but 2.0.0-1 is installed Product: Fedora Version: rawhide Component: jenkins Severity: urgent Assignee: msrb(a)redhat.com Reporter: dhill(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Description of problem: Jenkins is build with dom4j 1.6.1-27 but 2.0.0-1 is installed Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. Update to latest dom4j 2. 3. Actual results: Breaks jenkins Expected results: Doesn't break jenkins. Additional info: -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1451202] New: Please add logrotate file to Jenkins
by bugzilla＠redhat.com 30 Nov '18

30 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1451202 Bug ID: 1451202 Summary: Please add logrotate file to Jenkins Product: Fedora Version: rawhide Component: jenkins Severity: low Assignee: msrb(a)redhat.com Reporter: metonymy(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Please add the logrotate from ansible to the jenkins package. For details see: https://pagure.io/fedora-infrastructure/issue/6010 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1468722] New: Latest jenkins update breaks jenkins startup
by bugzilla＠redhat.com 30 Nov '18

30 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1468722 Bug ID: 1468722 Summary: Latest jenkins update breaks jenkins startup Product: Fedora Version: rawhide Component: jenkins Severity: low Assignee: msrb(a)redhat.com Reporter: dhill(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Description of problem: Latest jenkins update breaks jenkins startup and deleting the broken symlink /usr/share/jenkins/webroot/WEB-INF/lib/jnr-posix.jar solves the issue: java.io.FileNotFoundException: /usr/share/jenkins/webroot/WEB-INF/lib/jnr-posix.jar (No such file or directory) at java.io.FileInputStream.open0(Native Method) at java.io.FileInputStream.open(FileInputStream.java:195) at java.io.FileInputStream.<init>(FileInputStream.java:138) at org.eclipse.jetty.util.resource.FileResource.getInputStream(FileResource.java:286) at org.eclipse.jetty.webapp.JarScanner.matched(JarScanner.java:151) at org.eclipse.jetty.util.PatternMatcher.matchPatterns(PatternMatcher.java:100) at org.eclipse.jetty.util.PatternMatcher.match(PatternMatcher.java:82) at org.eclipse.jetty.webapp.JarScanner.scan(JarScanner.java:84) at org.eclipse.jetty.webapp.MetaInfConfiguration.preConfigure(MetaInfConfiguration.java:84) at org.eclipse.jetty.webapp.WebAppContext.preConfigure(WebAppContext.java:457) at winstone.HostConfiguration$1.preConfigure(HostConfiguration.java:166) at org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:493) at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:64) at org.eclipse.jetty.server.handler.HandlerWrapper.doStart(HandlerWrapper.java:95) at org.eclipse.jetty.server.Server.doStart(Server.java:282) at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:64) at winstone.Launcher.<init>(Launcher.java:152) at winstone.Launcher.main(Launcher.java:352) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at Main._main(Main.java:290) at Main.main(Main.java:104) Version-Release number of selected component (if applicable): How reproducible: Don't know Steps to Reproduce: 1. Update 2. 3. Actual results: Jenkins didn't restart Expected results: Jenkins should restart Additional info: -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1444418] New: CVE-2017-3586 CVE-2017-3589 mysql-connector-java: various flaws [fedora-all]
by bugzilla＠redhat.com 29 Nov '18

29 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1444418 Bug ID: 1444418 Summary: CVE-2017-3586 CVE-2017-3589 mysql-connector-java: various flaws [fedora-all] Product: Fedora Version: 25 Component: mysql-connector-java Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: puntogil(a)libero.it Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it, xjakub(a)fi.muni.cz This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1477541] New: CVE-2017-9801 apache-commons-email: SMTP header injection vulnerabilty [fedora-all]
by bugzilla＠redhat.com 27 Nov '18

27 Nov '18

https://bugzilla.redhat.com/show_bug.cgi?id=1477541 Bug ID: 1477541 Summary: CVE-2017-9801 apache-commons-email: SMTP header injection vulnerabilty [fedora-all] Product: Fedora Version: 26 Component: apache-commons-email Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: SpikeFedora(a)gmail.com Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, SpikeFedora(a)gmail.com This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits October 2017