December 2017 - java-sig-commits - Fedora mailing-lists

[Bug 1423762] New: jenkins-crypto-util: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423762 Bug ID: 1423762 Summary: jenkins-crypto-util: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-crypto-util Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-crypto-util failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727547 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423763] New: jenkins-external-monitor-job-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423763 Bug ID: 1423763 Summary: jenkins-external-monitor-job-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-external-monitor-job-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-external-monitor-job-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727551 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423764] New: jenkins-extras-memory-monitor: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423764 Bug ID: 1423764 Summary: jenkins-extras-memory-monitor: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-extras-memory-monitor Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-extras-memory-monitor failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727554 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423765] New: jenkins-icon-shim: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423765 Bug ID: 1423765 Summary: jenkins-icon-shim: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-icon-shim Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-icon-shim failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727568 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423766] New: jenkins-instance-identity: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423766 Bug ID: 1423766 Summary: jenkins-instance-identity: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-instance-identity Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-instance-identity failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727570 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423767] New: jenkins-javadoc-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423767 Bug ID: 1423767 Summary: jenkins-javadoc-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-javadoc-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-javadoc-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727580 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423769] New: jenkins-jexl: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423769 Bug ID: 1423769 Summary: jenkins-jexl: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-jexl Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-jexl failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727584 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423770] New: jenkins-junit-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423770 Bug ID: 1423770 Summary: jenkins-junit-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-junit-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-junit-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727612 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423771] New: jenkins-ldap-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423771 Bug ID: 1423771 Summary: jenkins-ldap-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-ldap-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-ldap-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727623 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423774] New: jenkins-mailer-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423774 Bug ID: 1423774 Summary: jenkins-mailer-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-mailer-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-mailer-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727653 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423775] New: jenkins-matrix-auth-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423775 Bug ID: 1423775 Summary: jenkins-matrix-auth-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-matrix-auth-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-matrix-auth-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727658 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423776] New: jenkins-matrix-project-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423776 Bug ID: 1423776 Summary: jenkins-matrix-project-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-matrix-project-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-matrix-project-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727671 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423777] New: jenkins-pam-auth-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423777 Bug ID: 1423777 Summary: jenkins-pam-auth-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-pam-auth-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-pam-auth-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727672 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423778] New: jenkins-remoting: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423778 Bug ID: 1423778 Summary: jenkins-remoting: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-remoting Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-remoting failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727679 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423779] New: jenkins-script-security-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423779 Bug ID: 1423779 Summary: jenkins-script-security-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-script-security-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-script-security-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727681 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423780] New: jenkins-ssh-cli-auth: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423780 Bug ID: 1423780 Summary: jenkins-ssh-cli-auth: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-ssh-cli-auth Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-ssh-cli-auth failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727685 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423781] New: jenkins-ssh-credentials-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423781 Bug ID: 1423781 Summary: jenkins-ssh-credentials-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-ssh-credentials-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-ssh-credentials-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727688 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423783] New: jenkins-ssh-slaves-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423783 Bug ID: 1423783 Summary: jenkins-ssh-slaves-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-ssh-slaves-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-ssh-slaves-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727692 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423784] New: jenkins-sshd: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423784 Bug ID: 1423784 Summary: jenkins-sshd: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-sshd Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-sshd failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727694 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423785] New: jenkins-xstream: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423785 Bug ID: 1423785 Summary: jenkins-xstream: FTBFS in rawhide Product: Fedora Version: rawhide Component: jenkins-xstream Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, msrb(a)redhat.com Blocks: 1423041 Your package jenkins-xstream failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17727704 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1423794] New: js-yui2: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423794 Bug ID: 1423794 Summary: js-yui2: FTBFS in rawhide Product: Fedora Version: rawhide Component: js-yui2 Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package js-yui2 failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17728612 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423796] New: json4s: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423796 Bug ID: 1423796 Summary: json4s: FTBFS in rawhide Product: Fedora Version: rawhide Component: json4s Assignee: willb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, willb(a)redhat.com Blocks: 1423041 Your package json4s failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17728801 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423917] New: mahout-collection-codegen-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423917 Bug ID: 1423917 Summary: mahout-collection-codegen-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: mahout-collection-codegen-plugin Assignee: besser82(a)fedoraproject.org Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: besser82(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, ml(a)lists.fedoraproject.org Blocks: 1423041 Your package mahout-collection-codegen-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17736618 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423922] New: maven-changelog-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423922 Bug ID: 1423922 Summary: maven-changelog-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: maven-changelog-plugin Assignee: huwang(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com Blocks: 1423041 Your package maven-changelog-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17737090 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423923] New: maven-ejb-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423923 Bug ID: 1423923 Summary: maven-ejb-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: maven-ejb-plugin Assignee: huwang(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org Blocks: 1423041 Your package maven-ejb-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17737161 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1423924] New: maven-help-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423924 Bug ID: 1423924 Summary: maven-help-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: maven-help-plugin Assignee: yyang(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, yyang(a)redhat.com Blocks: 1423041 Your package maven-help-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17737181 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423925] New: maven-hpi-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423925 Bug ID: 1423925 Summary: maven-hpi-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: maven-hpi-plugin Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package maven-hpi-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17737182 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1423926] New: maven-jaxb2-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423926 Bug ID: 1423926 Summary: maven-jaxb2-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: maven-jaxb2-plugin Assignee: puntogil(a)libero.it Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dchen(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mgoldman(a)redhat.com, puntogil(a)libero.it Blocks: 1423041 Your package maven-jaxb2-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17737219 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423927] New: maven-project-info-reports-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423927 Bug ID: 1423927 Summary: maven-project-info-reports-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: maven-project-info-reports-plugin Assignee: huwang(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Blocks: 1423041 Your package maven-project-info-reports-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17737259 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423928] New: maven-rar-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423928 Bug ID: 1423928 Summary: maven-rar-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: maven-rar-plugin Assignee: yyang(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, yyang(a)redhat.com Blocks: 1423041 Your package maven-rar-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17737260 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1423929] New: maven-repository-plugin: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1423929 Bug ID: 1423929 Summary: maven-repository-plugin: FTBFS in rawhide Product: Fedora Version: rawhide Component: maven-repository-plugin Assignee: yyang(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, yyang(a)redhat.com Blocks: 1423041 Your package maven-repository-plugin failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17737296 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1424038] New: owasp-java-html-sanitizer: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1424038 Bug ID: 1424038 Summary: owasp-java-html-sanitizer: FTBFS in rawhide Product: Fedora Version: rawhide Component: owasp-java-html-sanitizer Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package owasp-java-html-sanitizer failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17747065 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1238497] New: maven-invoker-plugin-2.0.0 is available
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1238497 Bug ID: 1238497 Summary: maven-invoker-plugin-2.0.0 is available Product: Fedora Version: rawhide Component: maven-invoker-plugin Keywords: FutureFeature, Triaged Assignee: weli(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, weli(a)redhat.com Latest upstream release: 2.0.0 Current version/release in rawhide: 1.10-2.fc23 URL: http://repo2.maven.org/maven2/org/apache/maven/plugins/maven-invoker-plugin/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=szOtEqGNHo&a=cc_unsubscribe

2 10

[Bug 1424327] New: rubygem-jruby-openssl: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1424327 Bug ID: 1424327 Summary: rubygem-jruby-openssl: FTBFS in rawhide Product: Fedora Version: rawhide Component: rubygem-jruby-openssl Assignee: msrb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Blocks: 1423041 Your package rubygem-jruby-openssl failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17790304 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1424419] New: scalaz: FTBFS in rawhide
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1424419 Bug ID: 1424419 Summary: scalaz: FTBFS in rawhide Product: Fedora Version: rawhide Component: scalaz Assignee: willb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, willb(a)redhat.com Blocks: 1423041 Your package scalaz failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17791292 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1220717] New: springframework-retry: tests throw org.springframework.beans.factory.NoSuchBeanDefinitionException
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1220717 Bug ID: 1220717 Summary: springframework-retry: tests throw org.springframework.beans.factory.NoSuchBeanDefinition Exception Product: Fedora Version: rawhide Component: springframework-retry Assignee: msrb(a)redhat.com Reporter: msrb(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Description of problem: Some of the tests in springframework-retry package throw org.springframework.beans.factory.NoSuchBeanDefinitionException from some reason. Investigate why. Version-Release number of selected component (if applicable): springframework-retry-1.1.1-2 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=LCNr7p1he2&a=cc_unsubscribe

2 6

[Bug 1333071] New: morfologik-stemming-2.1.0 is available
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1333071 Bug ID: 1333071 Summary: morfologik-stemming-2.1.0 is available Product: Fedora Version: rawhide Component: morfologik-stemming Assignee: puntogil(a)libero.it Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Latest upstream release: 2.1.0 Current version/release in rawhide: 2.0.1-3.fc24 URL: https://github.com/morfologik/morfologik-stemming/tags -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1366907] New: mysql-connector missing MysqlDataSourceFactory
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1366907 Bug ID: 1366907 Summary: mysql-connector missing MysqlDataSourceFactory Product: Fedora Version: 24 Component: mysql-connector-java Assignee: puntogil(a)libero.it Reporter: arnaud.kleinveld(a)ybo.com.sg QA Contact: extras-qa(a)fedoraproject.org CC: hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdornak(a)redhat.com, puntogil(a)libero.it, xjakub(a)fi.muni.cz Description of problem: Version-Release number of selected component (if applicable): 5.1.38-3 How reproducible: List contents of jar file and notice difference with distributed jar by MySQL Steps to Reproduce: 1.jar -tvf /usr/share/java/mysql-connector-java.jar|grep MysqlDataSourceFactory 2. 3. Actual results: No output Expected results: 3493 Wed Dec 02 09:01:44 ICT 2015 com/mysql/jdbc/jdbc2/optional/MysqlDataSourceFactory.class Additional info: -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1375228] New: lz4-java: Test failures on aarch64
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1375228 Bug ID: 1375228 Summary: lz4-java: Test failures on aarch64 Product: Fedora Version: rawhide Component: lz4-java Assignee: puntogil(a)libero.it Reporter: mizdebsk(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Blocks: 245418 (ARMTracker) %check tests are currently disabled on aarch64 because they fail. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=245418 [Bug 245418] Tracker for ARM support -- You are receiving this mail because: You are on the CC list for the bug.

2 8

[Bug 1509010] New: $ZOOCFGDIR needs to be added to classpath for log4j.properties
by bugzilla＠redhat.com 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1509010 Bug ID: 1509010 Summary: $ZOOCFGDIR needs to be added to classpath for log4j.properties Product: Fedora Version: 26 Component: zookeeper Assignee: tstclair(a)heptio.com Reporter: shawn.bohrer(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, greg.hellings(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, mluscon(a)gmail.com, s(a)shk.io, tstclair(a)heptio.com Description of problem: When setting up zookeeper I found to problems with logging. The first was that I needed to install: slf4j-log4j12-1.7.22-4.fc26.noarch I see that the zookeeper package depends on log4j12 and slf4j but not slf4j-log4j12. Next, once I had that installed I received the following warnings: log4j:WARN No appenders could be found for logger (org.apache.zookeeper.server.quorum.QuorumPeerConfig). log4j:WARN Please initialize the log4j system properly. log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info. This occurs because /etc/zookeeper needs to be added to the classpath, in order to find /etc/zookeeper/log4j.properties. Interestingly in /usr/libexec/zkEnv.sh there are the following lines: ZOOCFGDIR="/etc/zookeeper" ... #add the zoocfg dir to classpath CLASSPATH="/usr/share/java/zookeeper/zookeeper.jar" CLASSPATH="$CLASSPATH:/usr/share/java/zookeeper/zookeeper-ZooInspector.jar" CLASSPATH="$CLASSPATH:/usr/share/java/zookeeper/zookeeper-tests.jar" ... Despite that comment, it does not add $ZOOCFGDIR to the classpath which makes me think that perhaps it was removed or maybe they wrote the comment and never did it. There also does not appear to be any environment variables or similar ways to add additional items to the classpath so you must edit /usr/libexec/zkEnv.sh Version-Release number of selected component (if applicable): zookeeper-java-3.4.9-3.fc26.x86_64 zookeeper-3.4.9-3.fc26.x86_64 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1381310] New: glassfish-servlet-api: 4.0.0-b01 is available
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1381310 Bug ID: 1381310 Summary: glassfish-servlet-api: 4.0.0-b01 is available Product: Fedora Version: rawhide Component: glassfish-servlet-api Assignee: davidx(a)fedoraproject.org Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: davidx(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Upstream released axiom 4.0.0-b01. Currently, we still have version 3.1.0-11.fc25 in Rawhide. URL: https://svn.java.net/svn/glassfish~svn/tags/javax.servlet-api-4.0.0-b01 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1395997] New: jenkins-extras-memory-monitor: FTBFS in Fedora Rawhide
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1395997 Bug ID: 1395997 Summary: jenkins-extras-memory-monitor: FTBFS in Fedora Rawhide Product: Fedora Version: rawhide Component: jenkins-extras-memory-monitor Assignee: msrb(a)redhat.com Reporter: mizdebsk(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Description of problem: Package jenkins-extras-memory-monitor fails to build from source in Fedora Rawhide. The build uses deprecated "attached" goal of maven-assembly-plugin, which was removed in version 3.0.0. See: https://maven.apache.org/components/plugins-archives/maven-assembly-plugin-… Version-Release number of selected component (if applicable): 1.9-3.fc24 Steps to Reproduce: koji build --scratch f26 jenkins-extras-memory-monitor-1.9-3.fc24.src.rpm Additional info: This package is tracked by Koschei. See: http://apps.fedoraproject.org/koschei/package/jenkins-extras-memory-monitor -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1397462] New: littleproxy-1.1.0 is available
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1397462 Bug ID: 1397462 Summary: littleproxy-1.1.0 is available Product: Fedora Version: rawhide Component: littleproxy Assignee: puntogil(a)libero.it Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Latest upstream release: 1.1.0 Current version/release in rawhide: 0.5.3-3.fc25 URL: https://github.com/adamfisk/LittleProxy/tags gradle 3.1 BuildRequires -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1397498] New: native-platform-0.11 is available
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1397498 Bug ID: 1397498 Summary: native-platform-0.11 is available Product: Fedora Version: rawhide Component: native-platform Assignee: puntogil(a)libero.it Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, puntogil(a)libero.it Created attachment 1222763 --> https://bugzilla.redhat.com/attachment.cgi?id=1222763&action=edit update to 0.11 Latest upstream release: 0.11 Current version/release in rawhide: 0.10-8.fc24 URL: https://github.com/adammurdoch/native-platform/tags gradle 3.1 BuildRequires Task info: http://koji.fedoraproject.org/koji/taskinfo?taskID=16565100 -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1397510] New: pegdown-1.6.0 is available
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1397510 Bug ID: 1397510 Summary: pegdown-1.6.0 is available Product: Fedora Version: rawhide Component: pegdown Assignee: puntogil(a)libero.it Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, puntogil(a)libero.it Created attachment 1222784 --> https://bugzilla.redhat.com/attachment.cgi?id=1222784&action=edit update to 1.6.0 Latest upstream release: 1.6.0 Current version/release in rawhide: 1.4.2-9.fc25 URL: https://github.com/sirthias/pegdown/tags gradle 3.1 BuildRequires Task info: http://koji.fedoraproject.org/koji/taskinfo?taskID=16565789 -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1397523] New: parboiled-1.1.7 is available
by Red Hat Bugzilla 29 May '18

29 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1397523 Bug ID: 1397523 Summary: parboiled-1.1.7 is available Product: Fedora Version: rawhide Component: parboiled Assignee: puntogil(a)libero.it Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, puntogil(a)libero.it Created attachment 1222809 --> https://bugzilla.redhat.com/attachment.cgi?id=1222809&action=edit update to 1.1.7 Latest upstream release: 1.1.7 Current version/release in rawhide: 1.1.6-10.fc25 URL: https://github.com/sirthias/parboiled/tags Task info: http://koji.fedoraproject.org/koji/taskinfo?taskID=16566287 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1298915] New: fop-2.1 is available
by Red Hat Bugzilla 18 May '18

18 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1298915 Bug ID: 1298915 Summary: fop-2.1 is available Product: Fedora Version: rawhide Component: fop Keywords: FutureFeature, Triaged Assignee: r.landmann(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: c.david86(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com, rhbugs(a)n-dimensional.de, r.landmann(a)redhat.com Latest upstream release: 2.1 Current version/release in rawhide: 2.0-2.fc24 URL: http://archive.apache.org/dist/xmlgraphics/fop/source/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1418731] New: CVE-2017-2613 jenkins: User creation CSRF using GET by admins (SECURITY-406)
by bugzilla＠redhat.com 15 May '18

15 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1418731 Bug ID: 1418731 Summary: CVE-2017-2613 jenkins: User creation CSRF using GET by admins (SECURITY-406) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, tdawson(a)redhat.com, tiwillia(a)redhat.com The following flaw was found in Jenkins: When administrators accessed a URL like /user/example via HTTP GET, a user with the ID example was created if it did not exist. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records. Accessing these URLs now no longer results in a user record getting created, Jenkins will respond with 404 Not Found if no such user exists. When using the internal Jenkins user database, new users can be created via Manage Jenkins » Manage Users. To restore the previous (unsafe) behavior, set the system property hudson.model.User.allowUserCreationViaUrl to true as described on Features controlled by system properties. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017… Upstream patch: https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf192… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1418711] New: CVE-2017-2602 jenkins: Pipeline metadata files not blacklisted in agent-to-master security subsystem (SECURITY-358)
by bugzilla＠redhat.com 15 May '18

15 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1418711 Bug ID: 1418711 Summary: CVE-2017-2602 jenkins: Pipeline metadata files not blacklisted in agent-to-master security subsystem (SECURITY-358) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, tdawson(a)redhat.com, tiwillia(a)redhat.com The following flaw was found in Jenkins: The Pipeline suite of plugins stored build metadata in the file program.dat and the directory workflow/. These were not blacklisted in the agent-to-master security subsystem and could therefore be written to by malicious agents. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017… Upstream patch: https://github.com/jenkinsci/jenkins/commit/414ff7e30aba66bed18c4ee8a8660fb… -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1529312] New: CVE-2017-17810 nasm: Segfault via mishandled macro calls in asm/preproc.c
by bugzilla＠redhat.com 14 May '18

14 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529312 Bug ID: 1529312 Summary: CVE-2017-17810 nasm: Segfault via mishandled macro calls in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments. Upstream bug: https://bugzilla.nasm.us/show_bug.cgi?id=3392431 Upstream patch: http://repo.or.cz/nasm.git/commit/59ce1c67b16967c652765e62aa130b7e43f21dd4 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1524945] New: jenkins-plugin-script-security: Arbitrary file read vulnerability in Script Security Plugin (SECURITY-663 )
by bugzilla＠redhat.com 14 May '18

14 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1524945 Bug ID: 1524945 Summary: jenkins-plugin-script-security: Arbitrary file read vulnerability in Script Security Plugin (SECURITY-663) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com Users with the ability to configure sandboxed Groovy and Pipeline scripts, including those from SCM, are able to use a type coercion feature in Groovy to create new File objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Affected versions: Script Security Plugin up to and including 1.36 External References: https://jenkins.io/security/advisory/2017-12-11/ -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1459158] New: CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
by bugzilla＠redhat.com 14 May '18

14 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1459158 Bug ID: 1459158 Summary: CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: aileenc(a)redhat.com, alee(a)redhat.com, apintea(a)redhat.com, bkundal(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dimitris(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, felias(a)redhat.com, fgavrilo(a)redhat.com, gvarsami(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hhorak(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, joelsmith(a)redhat.com, jolee(a)redhat.com, jondruse(a)redhat.com, jorton(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, krzysztof.daniel(a)gmail.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, loleary(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net, mizdebsk(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, pjurak(a)redhat.com, ppalaga(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, rnetuka(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, spinder(a)redhat.com, sstavrev(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tkirby(a)redhat.com, trick(a)vanstaveren.us, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTT method. Tomcat's Default Servlet did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Affects: 7.0.0 to 7.0.77, 8.0.0.RC1 to 8.0.43, 8.5.0 to 8.5.14 Upstream fixes: Tomcat 7.x: https://svn.apache.org/viewvc?view=revision&revision=1793471 https://svn.apache.org/viewvc?view=revision&revision=1793491 Tomcat 8.0.x: https://svn.apache.org/viewvc?view=revision&revision=1793470 https://svn.apache.org/viewvc?view=revision&revision=1793489 Tomcat 8.5.x: https://svn.apache.org/viewvc?view=revision&revision=1793469 https://svn.apache.org/viewvc?view=revision&revision=1793488 External References: https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15 -- You are receiving this mail because: You are on the CC list for the bug.

1 66

[Bug 1508129] New: CVE-2016-5004 xmlrpc: XSS in Content-Encoding HTTP header of xmlrpc
by bugzilla＠redhat.com 14 May '18

14 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1508129 Bug ID: 1508129 Summary: CVE-2016-5004 xmlrpc: XSS in Content-Encoding HTTP header of xmlrpc Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: abhgupta(a)redhat.com, bmcclain(a)redhat.com, dbhole(a)redhat.com, dblechte(a)redhat.com, dwalluck(a)redhat.com, eedri(a)redhat.com, hhorak(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jorton(a)redhat.com, krzysztof.daniel(a)gmail.com, kseifried(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, puntogil(a)libero.it, sbonazzo(a)redhat.com, sherold(a)redhat.com, sochotni(a)redhat.com, tiwillia(a)redhat.com, ykaul(a)redhat.com, ylavi(a)redhat.com The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes. References: http://www.openwall.com/lists/oss-security/2016/07/12/5 https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1238245] New: maven-ear-plugin-2.10.1 is available
by Red Hat Bugzilla 13 May '18

13 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1238245 Bug ID: 1238245 Summary: maven-ear-plugin-2.10.1 is available Product: Fedora Version: rawhide Component: maven-ear-plugin Keywords: FutureFeature, Triaged Assignee: huwang(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org Latest upstream release: 2.10.1 Current version/release in rawhide: 2.10-2.fc23 URL: http://repo2.maven.org/maven2/org/apache/maven/plugins/maven-ear-plugin/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=noRQkekdeg&a=cc_unsubscribe

2 4

[Bug 1444759] New: CVE-2017-3523 mysql-connector-java: Connector/ J unspecified vulnerability (CPU Apr 2017)
by bugzilla＠redhat.com 09 May '18

09 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1444759 Bug ID: 1444759 Summary: CVE-2017-3523 mysql-connector-java: Connector/J unspecified vulnerability (CPU Apr 2017) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, avibelli(a)redhat.com, chazlett(a)redhat.com, coneill(a)redhat.com, databases-maint(a)redhat.com, gsterlin(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jcoleman(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, ldimaggi(a)redhat.com, mmuzila(a)redhat.com, mschorm(a)redhat.com, nwallace(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rwagner(a)redhat.com, tcunning(a)redhat.com, tiwillia(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com, xjakub(a)fi.muni.cz Blocks: 1444415 Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and eariler. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. External References: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html… -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1444406] New: CVE-2017-3586 mysql-connector-java: Connector/ J unspecified vulnerability (CPU Apr 2017)
by bugzilla＠redhat.com 09 May '18

09 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1444406 Bug ID: 1444406 Summary: CVE-2017-3586 mysql-connector-java: Connector/J unspecified vulnerability (CPU Apr 2017) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, avibelli(a)redhat.com, chazlett(a)redhat.com, coneill(a)redhat.com, databases-maint(a)redhat.com, gsterlin(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jcoleman(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, ldimaggi(a)redhat.com, mmuzila(a)redhat.com, mschorm(a)redhat.com, nwallace(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rwagner(a)redhat.com, tcunning(a)redhat.com, tiwillia(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com, xjakub(a)fi.muni.cz Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. External References: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html… -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1444407] New: CVE-2017-3589 mysql-connector-java: Connector/ J unspecified vulnerability (CPU Apr 2017)
by bugzilla＠redhat.com 09 May '18

09 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1444407 Bug ID: 1444407 Summary: CVE-2017-3589 mysql-connector-java: Connector/J unspecified vulnerability (CPU Apr 2017) Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, avibelli(a)redhat.com, chazlett(a)redhat.com, coneill(a)redhat.com, databases-maint(a)redhat.com, gsterlin(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jcoleman(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, ldimaggi(a)redhat.com, mmuzila(a)redhat.com, mschorm(a)redhat.com, nwallace(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rwagner(a)redhat.com, tcunning(a)redhat.com, tiwillia(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com, xjakub(a)fi.muni.cz Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. External References: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html… -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1291292] New: CVE-2015-5254 activemq: unsafe deserialization
by Red Hat Bugzilla 09 May '18

09 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1291292 Bug ID: 1291292 Summary: CVE-2015-5254 activemq: unsafe deserialization Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: abhgupta(a)redhat.com, agrimm(a)redhat.com, aileenc(a)redhat.com, ccoleman(a)redhat.com, chazlett(a)redhat.com, dmcphers(a)redhat.com, gvarsami(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jialiu(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, ldimaggi(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, puntogil(a)libero.it, rwagner(a)redhat.com, soa-p-jira(a)post-office.corp.redhat.com, s(a)shk.io, tcunning(a)redhat.com, tdawson(a)redhat.com, tiwillia(a)redhat.com, tkirby(a)redhat.com JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message transformation. As deserialization of untrusted data can leaed to security flaws as demonstrated in various reports, this leaves the broker vunerable to this attack vector. Additionally, applications that consume ObjectMessage type of messages can be vunerable as they deserlize objects on ObjectMessage.getObject() calls. This issue was fixed upstream in Apache ActiveMQ 5.13.0. Additionally, when using ObjectMessage message type, you need to explicitly list trusted packages. To see how to do that, please take a look at: http://activemq.apache.org/objectmessage.html External References: http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcem… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=gmTDQZJf60&a=cc_unsubscribe

2 39

[Bug 1418717] New: CVE-2017-2606 jenkins: Internal API allowed access to item names that should not be visible ( SECURITY-380)
by bugzilla＠redhat.com 08 May '18

08 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1418717 Bug ID: 1418717 Summary: CVE-2017-2606 jenkins: Internal API allowed access to item names that should not be visible (SECURITY-380) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, tdawson(a)redhat.com, tiwillia(a)redhat.com The following flaw was found in Jenkins: The method Jenkins#getItems() included a performance optimization that resulted in all items being returned if the Logged in users can do anything authorization strategy was used, and no access was granted to anonymous users (an option added in Jenkins 2.0). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017… Upstream patch: https://github.com/jenkinsci/jenkins/commit/09cfbc9cd5c9df7c763bc976b7f5c51… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1493189] New: CVE-2017-14228 nasm: NULL pointer dereference in the paste_tokens function
by bugzilla＠redhat.com 03 May '18

03 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1493189 Bug ID: 1493189 Summary: CVE-2017-14228 nasm: NULL pointer dereference in the paste_tokens function Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will lead to a denial of service. Upstream issue: https://bugzilla.nasm.us/show_bug.cgi?id=3392423 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1493190] New: CVE-2017-14228 nasm: NULL pointer dereference in the paste_tokens function [fedora-all]
by bugzilla＠redhat.com 03 May '18

03 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1493190 Bug ID: 1493190 Summary: CVE-2017-14228 nasm: NULL pointer dereference in the paste_tokens function [fedora-all] Product: Fedora Version: 26 Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: mizdebsk(a)redhat.com Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1340386] New: CVE-2016-4434 tika: XML External Entity vulnerability
by Red Hat Bugzilla 27 Apr '18

27 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1340386 Bug ID: 1340386 Summary: CVE-2016-4434 tika: XML External Entity vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: alazarot(a)redhat.com, aszczucz(a)redhat.com, bdawidow(a)redhat.com, bgollahe(a)redhat.com, bkearney(a)redhat.com, brms-jira(a)redhat.com, chazlett(a)redhat.com, epp-bugs(a)redhat.com, etirelli(a)redhat.com, felias(a)redhat.com, hchiorea(a)redhat.com, hfnukal(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, kanderso(a)redhat.com, lpetrovi(a)redhat.com, mbaluch(a)redhat.com, meissner(a)suse.de, mweiler(a)redhat.com, mwinkler(a)redhat.com, nwallace(a)redhat.com, ohudlick(a)redhat.com, pavelp(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rzhang(a)redhat.com, rzima(a)redhat.com, taw(a)redhat.com, theute(a)redhat.com, thomas(a)suse.de, tkasparek(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, vhalbert(a)redhat.com Apache Tika parses XML within numerous file formats. In some instances, such as spreadsheets in OOXML files, XMP in PDF, and other file formats, the initialization of the XML parser or the choice of handlers did not protect against XML External Entity (XXE) vulnerabilities. References: http://seclists.org/oss-sec/2016/q2/413 -- You are receiving this mail because: You are on the CC list for the bug.

2 28

[Bug 1340387] New: CVE-2016-4434 tika: XML External Entity vulnerability [ fedora-all]
by Red Hat Bugzilla 27 Apr '18

27 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1340387 Bug ID: 1340387 Summary: CVE-2016-4434 tika: XML External Entity vulnerability [fedora-all] Product: Fedora Version: 23 Component: tika Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: puntogil(a)libero.it Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Blocks: 1340386 (CVE-2016-4434) This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1340386 [Bug 1340386] CVE-2016-4434 tika: XML External Entity vulnerability -- You are receiving this mail because: You are on the CC list for the bug.

2 22

[Bug 1394157] New: CVE-2016-6809 tika: Native deserialization of Java objects in matlab files [fedora-all]
by Red Hat Bugzilla 27 Apr '18

27 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1394157 Bug ID: 1394157 Summary: CVE-2016-6809 tika: Native deserialization of Java objects in matlab files [fedora-all] Product: Fedora Version: 24 Component: tika Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: puntogil(a)libero.it Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Blocks: 1394156 (CVE-2016-6809) This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1394156 [Bug 1394156] CVE-2016-6809 tika: Native deserialization of Java objects in matlab files -- You are receiving this mail because: You are on the CC list for the bug.

2 10

[Bug 1396487] New: pdfbox-2.0.3 is available
by Red Hat Bugzilla 26 Apr '18

26 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1396487 Bug ID: 1396487 Summary: pdfbox-2.0.3 is available Product: Fedora Version: rawhide Component: pdfbox Assignee: puntogil(a)libero.it Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, orion(a)cora.nwra.com, puntogil(a)libero.it Latest upstream release: 2.0.3 Current version/release in rawhide: 1.8.12-2.fc26 URL: http://www.apache.org/dist/pdfbox/ Used by Apache Tika >= 1.13 -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1443585] New: CVE-2017-5661 fop: XML external entity processing vulnerability
by bugzilla＠redhat.com 26 Apr '18

26 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1443585 Bug ID: 1443585 Summary: CVE-2017-5661 fop: XML external entity processing vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: bmcclain(a)redhat.com, c.david86(a)gmail.com, dblechte(a)redhat.com, eedri(a)redhat.com, gklein(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, lsurette(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, rbalakri(a)redhat.com, rhbugs(a)n-dimensional.de, Rhev-m-bugs(a)redhat.com, r.landmann(a)redhat.com, sbonazzo(a)redhat.com, sherold(a)redhat.com, srevivo(a)redhat.com, ydary(a)redhat.com, ykaul(a)redhat.com In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack. References: https://xmlgraphics.apache.org/security.html http://seclists.org/oss-sec/2017/q2/86 -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1443592] New: CVE-2017-5662 batik: XML external entity processing vulnerability
by bugzilla＠redhat.com 26 Apr '18

26 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1443592 Bug ID: 1443592 Summary: CVE-2017-5662 batik: XML external entity processing vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: bmcclain(a)redhat.com, c.david86(a)gmail.com, dblechte(a)redhat.com, eedri(a)redhat.com, hhorak(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jorton(a)redhat.com, jvanek(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, sbonazzo(a)redhat.com, sherold(a)redhat.com, ydary(a)redhat.com, ykaul(a)redhat.com In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack. References: https://xmlgraphics.apache.org/security.html http://seclists.org/oss-sec/2017/q2/85 -- You are receiving this mail because: You are on the CC list for the bug.

1 19

[Bug 977249] New: htmlcleaner-2.5 is available
by Red Hat Bugzilla 24 Apr '18

24 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=977249 Bug ID: 977249 Summary: htmlcleaner-2.5 is available Product: Fedora Version: rawhide Component: htmlcleaner Keywords: FutureFeature, Triaged Severity: unspecified Priority: unspecified Assignee: Marcin.Dulak(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: bjoern.esser(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, Marcin.Dulak(a)gmail.com Latest upstream release: 2.5 Current version/release in Fedora Rawhide: 2.2.1-2.fc20 URL: http://sourceforge.net/api/file/index/project-name/htmlcleaner/mtime/desc/l… Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=B0wPSZFa2g&a=cc_unsubscribe

2 46

[Bug 1464158] New: CVE-2017-9735 jetty: Timing channel attack in util/ security/Password.java
by bugzilla＠redhat.com 23 Apr '18

23 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1464158 Bug ID: 1464158 Summary: CVE-2017-9735 jetty: Timing channel attack in util/security/Password.java Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: eclipse-sig(a)lists.fedoraproject.org, hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jjohnstn(a)redhat.com, jorton(a)redhat.com, krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com Jetty is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords. Upstream issue: https://github.com/eclipse/jetty.project/issues/1556 Upstream patch: https://github.com/eclipse/jetty.project/commit/042f325f1cd6e7891d72c7e668f… -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1372129] New: CVE-2016-6348 RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack
by Red Hat Bugzilla 20 Apr '18

20 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1372129 Bug ID: 1372129 Summary: CVE-2016-6348 RESTEasy: Use of JacksonJsonpInterceptor in RESTEasy can lead to Cross Site Script Inclusion attack Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: jshepherd(a)redhat.com CC: aileenc(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, aszczucz(a)redhat.com, bazulay(a)redhat.com, bbaranow(a)redhat.com, bdawidow(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmcclain(a)redhat.com, cbillett(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dblechte(a)redhat.com, dosoudil(a)redhat.com, eedri(a)redhat.com, epp-bugs(a)redhat.com, etirelli(a)redhat.com, felias(a)redhat.com, fnasser(a)redhat.com, gklein(a)redhat.com, gvarsami(a)redhat.com, hchiorea(a)redhat.com, hfnukal(a)redhat.com, huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jboss-set(a)redhat.com, jbpapp-maint(a)redhat.com, jcoleman(a)redhat.com, jdg-bugs(a)redhat.com, jmatthew(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, jshepherd(a)redhat.com, katello-bugs(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lpetrovi(a)redhat.com, lsurette(a)redhat.com, mbaluch(a)redhat.com, mgoldboi(a)redhat.com, mgoldman(a)redhat.com, miburman(a)redhat.com, michal.skrivanek(a)redhat.com, mmccune(a)redhat.com, mweiler(a)redhat.com, mwinkler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, ohadlevy(a)redhat.com, oourfali(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, pkliczew(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, puntogil(a)libero.it, rcernich(a)redhat.com, Rhev-m-bugs(a)redhat.com, rnetuka(a)redhat.com, rrajasek(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, rzhang(a)redhat.com, satellite6-bugs(a)redhat.com, sherold(a)redhat.com, soa-p-jira(a)post-office.corp.redhat.com, spinder(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, tomckay(a)redhat.com, tsanders(a)redhat.com, ttarrant(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com, ydary(a)redhat.com, ykaul(a)redhat.com It was found that in some configurations the JacksonJsonpInterceptor is activated by default in RESTEasy. An attacker could use this flaw to launch a Cross Site Scripting Inclusion attack. -- You are receiving this mail because: You are on the CC list for the bug.

2 13

[Bug 1372117] New: CVE-2016-6345 RESTEasy: Insufficient use of random values in RESTEasy async jobs could lead to loss of data confidentiality
by Red Hat Bugzilla 20 Apr '18

20 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1372117 Bug ID: 1372117 Summary: CVE-2016-6345 RESTEasy: Insufficient use of random values in RESTEasy async jobs could lead to loss of data confidentiality Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: jshepherd(a)redhat.com CC: aileenc(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, aszczucz(a)redhat.com, bazulay(a)redhat.com, bbaranow(a)redhat.com, bdawidow(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmcclain(a)redhat.com, cbillett(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dblechte(a)redhat.com, dosoudil(a)redhat.com, eedri(a)redhat.com, epp-bugs(a)redhat.com, etirelli(a)redhat.com, felias(a)redhat.com, fnasser(a)redhat.com, gklein(a)redhat.com, gvarsami(a)redhat.com, hchiorea(a)redhat.com, hfnukal(a)redhat.com, huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jboss-set(a)redhat.com, jbpapp-maint(a)redhat.com, jcoleman(a)redhat.com, jdg-bugs(a)redhat.com, jmatthew(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, jshepherd(a)redhat.com, katello-bugs(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lpetrovi(a)redhat.com, lsurette(a)redhat.com, mbaluch(a)redhat.com, mgoldboi(a)redhat.com, mgoldman(a)redhat.com, miburman(a)redhat.com, michal.skrivanek(a)redhat.com, mmccune(a)redhat.com, mweiler(a)redhat.com, mwinkler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, ohadlevy(a)redhat.com, oourfali(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, pkliczew(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, puntogil(a)libero.it, rcernich(a)redhat.com, Rhev-m-bugs(a)redhat.com, rnetuka(a)redhat.com, rrajasek(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, rzhang(a)redhat.com, satellite6-bugs(a)redhat.com, sherold(a)redhat.com, soa-p-jira(a)post-office.corp.redhat.com, spinder(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, tomckay(a)redhat.com, tsanders(a)redhat.com, ttarrant(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com, ydary(a)redhat.com, ykaul(a)redhat.com It was found that there was insufficient use of randam values in RESTEasy async jobs. An attacker could use this flaw to steal user data. -- You are receiving this mail because: You are on the CC list for the bug.

2 21

[Bug 1340421] New: apache-poi-3.15-beta1-20160409 is available
by Red Hat Bugzilla 18 Apr '18

18 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1340421 Bug ID: 1340421 Summary: apache-poi-3.15-beta1-20160409 is available Product: Fedora Version: rawhide Component: apache-poi Assignee: mat.booth(a)redhat.com Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)redhat.com, puntogil(a)libero.it Latest upstream release: 3.15-beta1-20160409 Current version/release in rawhide: 3.14-1.fc25 URL: http://www.apache.org/dist/poi/dev/src/ http://www.apache.org/dist/poi/release/src Please, consider upgrading -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1443635] New: CVE-2017-5645 log4j: Socket receiver deserialization vulnerability
by bugzilla＠redhat.com 16 Apr '18

16 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1443635 Bug ID: 1443635 Summary: CVE-2017-5645 log4j: Socket receiver deserialization vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: aileenc(a)redhat.com, alazarot(a)redhat.com, aortega(a)redhat.com, apevec(a)redhat.com, avibelli(a)redhat.com, ayoung(a)redhat.com, bkearney(a)redhat.com, bmcclain(a)redhat.com, cbillett(a)redhat.com, chazlett(a)redhat.com, chrisw(a)redhat.com, coneill(a)redhat.com, csutherl(a)redhat.com, cvsbot-xmlrpc(a)redhat.com, dandread(a)redhat.com, dblechte(a)redhat.com, devrim(a)gunduz.org, dwalluck(a)redhat.com, eedri(a)redhat.com, etirelli(a)redhat.com, gklein(a)redhat.com, gsterlin(a)redhat.com, gvarsami(a)redhat.com, gzaronik(a)redhat.com, hhorak(a)redhat.com, huwang(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jjoyce(a)redhat.com, jorton(a)redhat.com, jschluet(a)redhat.com, jshepherd(a)redhat.com, kbasil(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, lpetrovi(a)redhat.com, lsurette(a)redhat.com, markmc(a)redhat.com, mbabacek(a)redhat.com, mbaluch(a)redhat.com, meissner(a)suse.de, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, mwinkler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, rbalakri(a)redhat.com, rbryant(a)redhat.com, Rhev-m-bugs(a)redhat.com, rrajasek(a)redhat.com, rwagner(a)redhat.com, rzhang(a)redhat.com, sclewis(a)redhat.com, sherold(a)redhat.com, spinder(a)redhat.com, srevivo(a)redhat.com, taw(a)redhat.com, tcunning(a)redhat.com, tdecacqu(a)redhat.com, theute(a)redhat.com, thomas(a)suse.de, tjay(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, tomckay(a)redhat.com, twalsh(a)redhat.com, weli(a)redhat.com, ydary(a)redhat.com, ykaul(a)redhat.com When using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. References: http://seclists.org/oss-sec/2017/q2/78 Upstream bug: https://issues.apache.org/jira/browse/LOG4J2-1863 -- You are receiving this mail because: You are on the CC list for the bug.

1 72

[Bug 1510896] New: Problem to start tomcat with a user whose group has a name different to the user
by bugzilla＠redhat.com 10 Apr '18

10 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1510896 Bug ID: 1510896 Summary: Problem to start tomcat with a user whose group has a name different to the user Product: Fedora Version: rawhide Component: tomcat Severity: medium Assignee: ivan.afonichev(a)gmail.com Reporter: csutherl(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, aneelica(a)redhat.com, csutherl(a)redhat.com, djorm(a)redhat.com, dknox(a)redhat.com, etienne.carriere(a)finances.gouv.fr, hajek(a)oakland.edu, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jclere(a)redhat.com, jonderka(a)redhat.com, krzysztof.daniel(a)gmail.com, lnovich(a)redhat.com, luvilla(a)redhat.com, mbabacek(a)redhat.com, mczernek(a)redhat.com, me(a)coolsvap.net, mhasko(a)redhat.com, rhatlapa(a)redhat.com, tfonteyn(a)redhat.com, tomcat-qe(a)redhat.com Depends On: 1505762, 915447 Blocks: 835616 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=915447 [Bug 915447] Problem to start tomcat with a user whose group has a name different to the user https://bugzilla.redhat.com/show_bug.cgi?id=1505762 [Bug 1505762] Problem to start tomcat with a user whose group has a name different to the user -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1526596] New: jenkins: CSRF protection delayed after startup
by bugzilla＠redhat.com 09 Apr '18

09 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1526596 Bug ID: 1526596 Summary: jenkins: CSRF protection delayed after startup Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com A race condition during Jenkins startup could result in the wrong order of execution of commands during initialization. There’s a very short window of time after startup during which Jenkins may no longer show the "Please wait while Jenkins is getting ready to work" message, but Cross-Site Request Forgery (CSRF) protection may not yet be effective. External references: https://jenkins.io/security/advisory/2017-12-14/ -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1522902] New: jenkins: Stored XSS vulnerability in tool names exploitable by administrators ( SECURITY-624)
by bugzilla＠redhat.com 09 Apr '18

09 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1522902 Bug ID: 1522902 Summary: jenkins: Stored XSS vulnerability in tool names exploitable by administrators (SECURITY-624) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com Jenkins administrators can configure tools, such as JDK, Maven, or Ant, that will be available in job configurations for use by build scripts. Some tool names are not properly escaped on job configuration forms, resulting in a stored cross-site scripting vulnerability. Tools confirmed to be affected are: JDK (provided by Jenkins core) Ant (provided by Ant plugin) Others may also be affected by this. This vulnerability can only be exploited by Jenkins administrators, as they’re the only ones able to define tools. In the vast majority of Jenkins configurations, administrators are able to run any code and install any plugin. Therefore this vulnerability only really affects installations that don’t grant administrators the Run Scripts, Configure Update Sites, and Install Plugins permissions. The Jenkins project has prepared a plugin preventing the configuration of unsafe tool names at https://github.com/jenkinsci-cert/security624 as a workaround. External References: https://jenkins.io/security/advisory/2017-12-05/ -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1501817] New: jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618)
by bugzilla＠redhat.com 03 Apr '18

03 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1501817 Bug ID: 1501817 Summary: jenkins: "Queue Item" remote API disclosed information about inaccessible jobs (SECURITY-618) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com The remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to start). This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Job/Read permission. External References: https://jenkins.io/security/advisory/2017-10-11/ -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1501816] New: jenkins: "Computer" remote API disclosed information about inaccessible jobs (SECURITY-611)
by bugzilla＠redhat.com 03 Apr '18

03 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1501816 Bug ID: 1501816 Summary: jenkins: "Computer" remote API disclosed information about inaccessible jobs (SECURITY-611) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com The remote API at /computer/(agent-name)/api showed information about tasks (typically builds) currently running on that agent. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Job/Read permission. External References: https://jenkins.io/security/advisory/2017-10-11/ -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1501814] New: jenkins: "User" remote API disclosed users' email addresses (SECURITY-514)
by bugzilla＠redhat.com 03 Apr '18

03 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1501814 Bug ID: 1501814 Summary: jenkins: "User" remote API disclosed users' email addresses (SECURITY-514) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com Information about Jenkins user accounts is generally available to anyone with Overall/Read permissions via the /user/(username)/api remote API. This included e.g. Jenkins users' email addresses if the Mailer Plugin is installed. External References: https://jenkins.io/security/advisory/2017-10-11/ -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1501820] New: jenkins: Jenkins core bundled vulnerable version of the commons-httpclient library (SECURITY-555)
by bugzilla＠redhat.com 03 Apr '18

03 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1501820 Bug ID: 1501820 Summary: jenkins: Jenkins core bundled vulnerable version of the commons-httpclient library (SECURITY-555) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com Jenkins bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. External References: https://jenkins.io/security/advisory/2017-10-11/ -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1501818] New: jenkins: "Job" remote API disclosed information about inaccessible upstream/ downstream jobs (SECURITY-617)
by bugzilla＠redhat.com 02 Apr '18

02 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1501818 Bug ID: 1501818 Summary: jenkins: "Job" remote API disclosed information about inaccessible upstream/downstream jobs (SECURITY-617) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com The remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Job/Read permission. External References: https://jenkins.io/security/advisory/2017-10-11/ -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1434338] New: CVE-2017-2651 jenkins-mailer-plugin: Emails were sent to addresses not associated with actual users of Jenkins by Mailer Plugin
by bugzilla＠redhat.com 02 Apr '18

02 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1434338 Bug ID: 1434338 Summary: CVE-2017-2651 jenkins-mailer-plugin: Emails were sent to addresses not associated with actual users of Jenkins by Mailer Plugin Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com, tdawson(a)redhat.com The Mailer and Email Extension Plugins are able to send emails to a dynamically created list of users based on the changelogs, like authors of SCM changes since the last successful build. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses. Affected versions: up to and including version 1.19 External Reference: https://jenkins.io/security/advisory/2017-03-20/ -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1501812] New: jenkins: Arbitrary shell command execution on master by users with Agent-related permissions (SECURITY-478)
by bugzilla＠redhat.com 02 Apr '18

02 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1501812 Bug ID: 1501812 Summary: jenkins: Arbitrary shell command execution on master by users with Agent-related permissions (SECURITY-478) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com Users with permission to create or configure agents in Jenkins could configure a launch method called Launch agent via execution of command on master. This allowed them to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. External References: https://jenkins.io/security/advisory/2017-10-11/ -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1501813] New: jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490)
by bugzilla＠redhat.com 02 Apr '18

02 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1501813 Bug ID: 1501813 Summary: jenkins: Jenkins core bundled vulnerable version of the commons-fileupload library (SECURITY-490) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com Jenkins bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092. External References: https://jenkins.io/security/advisory/2017-10-11/ -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1508473] New: 3.9.0 is available
by bugzilla＠redhat.com 31 Mar '18

31 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1508473 Bug ID: 1508473 Summary: 3.9.0 is available Product: Fedora Version: rawhide Component: okhttp Assignee: puntogil(a)libero.it Reporter: mgansser(a)online.de QA Contact: extras-qa(a)fedoraproject.org CC: gerard(a)ryan.lt, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, puntogil(a)libero.it 3.9.0 of okhttp is available https://github.com/square/okhttp -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1501819] New: jenkins: Form validation for password fields was sent via GET (SECURITY-616)
by bugzilla＠redhat.com 21 Mar '18

21 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1501819 Bug ID: 1501819 Summary: jenkins: Form validation for password fields was sent via GET (SECURITY-616) Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com The Jenkins default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. External References: https://jenkins.io/security/advisory/2017-10-11/ -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1446114] New: CVE-2017-1000353 jenkins: Unauthenticated remote code execution (SECURITY-429)
by bugzilla＠redhat.com 20 Mar '18

20 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1446114 Bug ID: 1446114 Summary: CVE-2017-1000353 jenkins: Unauthenticated remote code execution (SECURITY-429) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, tdawson(a)redhat.com, tiwillia(a)redhat.com An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java SignedObject object to the remoting-based Jenkins CLI, that would be deserialized using a new ObjectInputStream, bypassing the existing blacklist-based protection mechanism. SignedObject has been added to the remoting blacklist. In Jenkins 2.54, the remoting-based CLI protocol was deprecated and a new, HTTP based protocol introduced as the new default, in addition to the existing SSH-based CLI. This feature has been backported to Jenkins 2.46.2. It is strongly recommended that users upgrading Jenkins disable the remoting-based CLI, and use the one of the other modes (HTTP or SSH) instead. Affected versions: All Jenkins main line releases up to and including 2.56 All Jenkins LTS releases up to and including 2.46.1 Fixed in: Jenkins main line users should update to 2.57 Jenkins LTS users should update to 2.46.2 External Reference: https://jenkins.io/security/advisory/2017-04-26/ -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1321205] New: tomcat-8.5.0 is available
by Red Hat Bugzilla 19 Mar '18

19 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1321205 Bug ID: 1321205 Summary: tomcat-8.5.0 is available Product: Fedora Version: rawhide Component: tomcat Keywords: FutureFeature, Triaged Assignee: ivan.afonichev(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com, me(a)coolsvap.net Latest upstream release: 8.5.0 Current version/release in rawhide: 8.0.32-4.fc25 URL: http://tomcat.apache.org/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/4987/ -- You are receiving this mail because: You are on the CC list for the bug.

2 55

[Bug 1462416] New: maven-shared-utils-3.2.0 is available
by bugzilla＠redhat.com 15 Mar '18

15 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1462416 Bug ID: 1462416 Summary: maven-shared-utils-3.2.0 is available Product: Fedora Version: rawhide Component: maven-shared-utils Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Latest upstream release: 3.2.0 Current version/release in rawhide: 3.1.0-4.fc26 URL: http://repo1.maven.org/maven2/org/apache/maven/shared/maven-shared-utils/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1940/ -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1493220] New: CVE-2017-12615 tomcat: Remote Code Execution via JSP Upload
by bugzilla＠redhat.com 07 Mar '18

07 Mar '18

https://bugzilla.redhat.com/show_bug.cgi?id=1493220 Bug ID: 1493220 Summary: CVE-2017-12615 tomcat: Remote Code Execution via JSP Upload Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: akurtako(a)redhat.com, alee(a)redhat.com, apintea(a)redhat.com, bkundal(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dimitris(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, felias(a)redhat.com, fgavrilo(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hhorak(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, jolee(a)redhat.com, jondruse(a)redhat.com, jorton(a)redhat.com, jshepherd(a)redhat.com, krzysztof.daniel(a)gmail.com, lgao(a)redhat.com, loleary(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net, mizdebsk(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, pjurak(a)redhat.com, ppalaga(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, rnetuka(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, spinder(a)redhat.com, sstavrev(a)redhat.com, theute(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. Affected versions: 7.0.0 to 7.0.79 External References: https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81 -- You are receiving this mail because: You are on the CC list for the bug.

1 38

[Bug 1340302] New: owasp-java-html-sanitizer-20160526.1 is available
by Red Hat Bugzilla 20 Feb '18

20 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1340302 Bug ID: 1340302 Summary: owasp-java-html-sanitizer-20160526.1 is available Product: Fedora Version: rawhide Component: owasp-java-html-sanitizer Keywords: FutureFeature, Triaged Assignee: msrb(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Latest upstream release: 20160526.1 Current version/release in rawhide: 20160422.1-1.fc25 URL: https://github.com/OWASP/java-html-sanitizer Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/2579/ -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1455566] New: CVE-2014-9970 jasypt: Vulnerable to timing attack against the password hash comparison
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1455566 Bug ID: 1455566 Summary: CVE-2014-9970 jasypt: Vulnerable to timing attack against the password hash comparison Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, alazarot(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, bmcclain(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dblechte(a)redhat.com, dosoudil(a)redhat.com, eedri(a)redhat.com, etirelli(a)redhat.com, gvarsami(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jcoleman(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lpetrovi(a)redhat.com, mbaluch(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mwinkler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rnetuka(a)redhat.com, rrajasek(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, rzhang(a)redhat.com, sherold(a)redhat.com, tcunning(a)redhat.com, tiwillia(a)redhat.com, tkirby(a)redhat.com, twalsh(a)redhat.com, vtunka(a)redhat.com, ydary(a)redhat.com, ykaul(a)redhat.com It was found that jasypt before allows a timing attack against the password hash comparison. Upstream patch: https://sourceforge.net/p/jasypt/code/668/ -- You are receiving this mail because: You are on the CC list for the bug.

1 22

[Bug 1480618] New: CVE-2017-7674 tomcat: Cache Poisoning
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1480618 Bug ID: 1480618 Summary: CVE-2017-7674 tomcat: Cache Poisoning Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: aileenc(a)redhat.com, alee(a)redhat.com, apintea(a)redhat.com, bkundal(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dimitris(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, felias(a)redhat.com, fgavrilo(a)redhat.com, gvarsami(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hhorak(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, jolee(a)redhat.com, jondruse(a)redhat.com, jorton(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, krzysztof.daniel(a)gmail.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, loleary(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net, mizdebsk(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, pjurak(a)redhat.com, ppalaga(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, rnetuka(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, spinder(a)redhat.com, sstavrev(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tkirby(a)redhat.com, trick(a)vanstaveren.us, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com The CORS Filter did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. Affected versions: 7.0.41 to 7.0.78, 8.0.0.RC1 to 8.0.44, 8.5.0 to 8.5.15 Upstream patches: Tomcat 7: https://svn.apache.org/viewvc?view=revision&revision=1795816 Tomcat 8.0.x: https://svn.apache.org/viewvc?view=revision&revision=1795815 Tomcat 8.5.x: https://svn.apache.org/viewvc?view=revision&revision=1795814 External References: https://tomcat.apache.org/security-7.html https://tomcat.apache.org/security-8.html -- You are receiving this mail because: You are on the CC list for the bug.

1 25

[Bug 1524585] New: CVE-2016-4216 xmpcore: XXE resulting in information disclosure
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1524585 Bug ID: 1524585 Summary: CVE-2016-4216 xmpcore: XXE resulting in information disclosure Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: alazarot(a)redhat.com, anstephe(a)redhat.com, cedric.olivier(a)free.fr, etirelli(a)redhat.com, felias(a)redhat.com, hchiorea(a)redhat.com, ibek(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jolee(a)redhat.com, kverlaen(a)redhat.com, lpetrovi(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pavelp(a)redhat.com, pszubiak(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rsynek(a)redhat.com, rzhang(a)redhat.com, sdaley(a)redhat.com, vhalbert(a)redhat.com XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. External References: https://helpx.adobe.com/security/products/xmpcore/apsb16-24.html -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1454808] New: CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four letter words
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1454808 Bug ID: 1454808 Summary: CVE-2017-5637 zookeeper: Incorrect input validation with wchp/wchc four letter words Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, alazarot(a)redhat.com, chazlett(a)redhat.com, ctubbsii(a)fedoraproject.org, ethan(a)ethantuttle.com, etirelli(a)redhat.com, felias(a)redhat.com, hchiorea(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jolee(a)redhat.com, kseifried(a)redhat.com, kverlaen(a)redhat.com, lpetrovi(a)redhat.com, mbaluch(a)redhat.com, mluscon(a)gmail.com, mwinkler(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, rrajasek(a)redhat.com, rzhang(a)redhat.com, s(a)shk.io, tiwillia(a)redhat.com, tkirby(a)redhat.com, tstclair(a)heptio.com, vhalbert(a)redhat.com Two four letter word commands “wchp/wchc” are CPU intensive and could cause spike of CPU utilization on ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Upstream issue: https://issues.apache.org/jira/browse/ZOOKEEPER-2693 References: https://vulners.com/exploitdb/EDB-ID:41277 -- You are receiving this mail because: You are on the CC list for the bug.

1 20

[Bug 1441223] New: CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1441223 Bug ID: 1441223 Summary: CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: alee(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, felias(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hhorak(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, joelsmith(a)redhat.com, jolee(a)redhat.com, jorton(a)redhat.com, jshepherd(a)redhat.com, krzysztof.daniel(a)gmail.com, lgao(a)redhat.com, mbabacek(a)redhat.com, me(a)coolsvap.net, mizdebsk(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, psotirop(a)redhat.com, rnetuka(a)redhat.com, rsvoboda(a)redhat.com, spinder(a)redhat.com, theute(a)redhat.com, trick(a)vanstaveren.us, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com While investigating bug 60718, it was noticed that some calls to application listeners did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application. Upstream fixes: Tomcat 7.x: https://svn.apache.org/viewvc?view=revision&revision=1785777 Tomcat 8.0.x: https://svn.apache.org/viewvc?view=revision&revision=1785776 Tomcat 8.5.x: https://svn.apache.org/viewvc?view=revision&revision=1785775 References: https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.76 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.42 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.12 -- You are receiving this mail because: You are on the CC list for the bug.

1 28

[Bug 1441205] New: CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1441205 Bug ID: 1441205 Summary: CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: aileenc(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, etirelli(a)redhat.com, felias(a)redhat.com, gvarsami(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hhorak(a)redhat.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, joelsmith(a)redhat.com, jolee(a)redhat.com, jorton(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lpetrovi(a)redhat.com, mbabacek(a)redhat.com, mbaluch(a)redhat.com, me(a)coolsvap.net, mizdebsk(a)redhat.com, mwinkler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, psotirop(a)redhat.com, rnetuka(a)redhat.com, rrajasek(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, rzhang(a)redhat.com, spinder(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tkirby(a)redhat.com, trick(a)vanstaveren.us, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com A bug in the handling of the pipelined requests when send file was used resulted in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C. Affected versions: 6.0.0 to 6.0.52, 7.0.0 to 7.0.76, 8.0.0.RC1 to 8.0.42 Fixed in revisions: Tomcat 6: https://svn.apache.org/viewvc?view=revision&revision=1789024 https://svn.apache.org/viewvc?view=revision&revision=1789155 https://svn.apache.org/viewvc?view=revision&revision=1789856 Tomcat 7: https://svn.apache.org/viewvc?view=revision&revision=1789008 Tomcat 8: https://svn.apache.org/viewvc?view=revision&revision=1788999 References: https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.53 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.77 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.43 -- You are receiving this mail because: You are on the CC list for the bug.

1 45

[Bug 1397484] New: CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests
by Red Hat Bugzilla 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1397484 Bug ID: 1397484 Summary: CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: aileenc(a)redhat.com, alee(a)redhat.com, aszczucz(a)redhat.com, bbaranow(a)redhat.com, bdawidow(a)redhat.com, bgollahe(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, epp-bugs(a)redhat.com, felias(a)redhat.com, fnasser(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hfnukal(a)redhat.com, hhorak(a)redhat.com, ivan.afonichev(a)gmail.com, jason.greene(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jboss-set(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdg-bugs(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, jialiu(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jshepherd(a)redhat.com, kanderso(a)redhat.com, krzysztof.daniel(a)gmail.com, lgao(a)redhat.com, lmeyer(a)redhat.com, mbabacek(a)redhat.com, mbaluch(a)redhat.com, me(a)coolsvap.net, miburman(a)redhat.com, mizdebsk(a)redhat.com, mmccomas(a)redhat.com, mnewsome(a)redhat.com, mweiler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, ohudlick(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, rnetuka(a)redhat.com, rsvoboda(a)redhat.com, rzima(a)redhat.com, spinder(a)redhat.com, theute(a)redhat.com, trick(a)vanstaveren.us, ttarrant(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com The code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6 Upstream patches: Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767683 Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767675 Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767653 Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767645 External References: https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8 -- You are receiving this mail because: You are on the CC list for the bug.

2 48

[Bug 1376712] New: CVE-2016-1240 tomcat: Local privilege escalation via unsafe file handling in the Tomcat init script
by Red Hat Bugzilla 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1376712 Bug ID: 1376712 Summary: CVE-2016-1240 tomcat: Local privilege escalation via unsafe file handling in the Tomcat init script Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: alee(a)redhat.com, aszczucz(a)redhat.com, bbaranow(a)redhat.com, bdawidow(a)redhat.com, bgollahe(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, epp-bugs(a)redhat.com, felias(a)redhat.com, fnasser(a)redhat.com, hchiorea(a)redhat.com, hfnukal(a)redhat.com, hhorak(a)redhat.com, ivan.afonichev(a)gmail.com, jason.greene(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jboss-set(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdg-bugs(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, jialiu(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jshepherd(a)redhat.com, kanderso(a)redhat.com, krzysztof.daniel(a)gmail.com, lgao(a)redhat.com, lmeyer(a)redhat.com, mbabacek(a)redhat.com, mbaluch(a)redhat.com, me(a)coolsvap.net, miburman(a)redhat.com, mizdebsk(a)redhat.com, mmccomas(a)redhat.com, mnewsome(a)redhat.com, mweiler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, ohudlick(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, rnetuka(a)redhat.com, rsvoboda(a)redhat.com, rzima(a)redhat.com, spinder(a)redhat.com, theute(a)redhat.com, trick(a)vanstaveren.us, ttarrant(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. References: http://seclists.org/bugtraq/2016/Sep/26 -- You are receiving this mail because: You are on the CC list for the bug.

2 31

[Bug 1520471] New: CVE-2017-14949 restlet: XXE vulnerability in XML extension allows remote attackers to access arbitrary files via a crafted REST API HTTP request
by bugzilla＠redhat.com 12 Feb '18

12 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1520471 Bug ID: 1520471 Summary: CVE-2017-14949 restlet: XXE vulnerability in XML extension allows remote attackers to access arbitrary files via a crafted REST API HTTP request Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: aileenc(a)redhat.com, chazlett(a)redhat.com, gvarsami(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, kconner(a)redhat.com, ldimaggi(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, puntogil(a)libero.it, rwagner(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation. External References: https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhance… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits December 2017