December 2017 - java-sig-commits - Fedora mailing-lists

[Bug 1516791] New: CVE-2017-1000392 jenkins: Persisted XSS vulnerability in autocompletion suggestions
by bugzilla＠redhat.com 01 Feb '18

01 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1516791 Bug ID: 1516791 Summary: CVE-2017-1000392 jenkins: Persisted XSS vulnerability in autocompletion suggestions Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters. Known previously unsafe sources for these suggestions include the names of loggers in the log recorder condition, and agent labels. External References: https://jenkins.io/security/advisory/2017-11-08/ -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1516788] New: CVE-2017-1000391 jenkins: Unsafe use of user names as directory names
by bugzilla＠redhat.com 01 Feb '18

01 Feb '18

https://bugzilla.redhat.com/show_bug.cgi?id=1516788 Bug ID: 1516788 Summary: CVE-2017-1000391 jenkins: Unsafe use of user names as directory names Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com Jenkins stores metadata related to people, which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping. This potentially resulted in a number of problems, such as the following: 1. User names consisting of a single forward slash would have their user record stored in the parent directory; deleting this user deleted all user records. 2. User names containing character sequences such as .. could be used to clobber other configuration files in Jenkins. This is not limited to the Jenkins user database security realm, other security realms such as LDAP may allow users to create user names that result in problems in Jenkins. External References: https://jenkins.io/security/advisory/2017-11-08/ -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1382979] New: jenkins-ant-plugin-1.4 is available
by Red Hat Bugzilla 22 Jan '18

22 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1382979 Bug ID: 1382979 Summary: jenkins-ant-plugin-1.4 is available Product: Fedora Version: rawhide Component: jenkins-ant-plugin Keywords: FutureFeature, Triaged Assignee: msrb(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Latest upstream release: 1.4 Current version/release in rawhide: 1.2-6.fc24 URL: https://wiki.jenkins-ci.org/display/JENKINS/Ant+Plugin Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/6326/ -- You are receiving this mail because: You are on the CC list for the bug.

2 4

[Bug 1424418] New: sbt: FTBFS in rawhide
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1424418 Bug ID: 1424418 Summary: sbt: FTBFS in rawhide Product: Fedora Version: rawhide Component: sbt Assignee: willb(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, s(a)shk.io, willb(a)redhat.com Blocks: 1423041 Your package sbt failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17791279 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1529336] New: CVE-2017-17810 CVE-2017-17811 CVE-2017-17812 CVE-2017-17813 CVE-2017-17814 CVE-2017-17815 CVE-2017-17816 CVE-2017-17817 CVE-2017-17818 CVE-2017-17819 CVE-2017-17820 nasm : various flaws [fedora-all]
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529336 Bug ID: 1529336 Summary: CVE-2017-17810 CVE-2017-17811 CVE-2017-17812 CVE-2017-17813 CVE-2017-17814 CVE-2017-17815 CVE-2017-17816 CVE-2017-17817 CVE-2017-17818 CVE-2017-17819 CVE-2017-17820 nasm: various flaws [fedora-all] Product: Fedora Version: 27 Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: mizdebsk(a)redhat.com Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 20

[Bug 1529335] New: CVE-2017-17820 nasm: Use-after-free in pp_list_one_macro function in asm/preproc.c
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529335 Bug ID: 1529335 Summary: CVE-2017-17820 nasm: Use-after-free in pp_list_one_macro function in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_list_one_macro in asm/preproc.c that will lead to denial of service, related to mishandling of operand-type errors. Upstream bug: https://bugzilla.nasm.us/show_bug.cgi?id=3392433 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1529334] New: CVE-2017-17819 nasm: Illegal address access in find_cc function in asm/preproc.c
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529334 Bug ID: 1529334 Summary: CVE-2017-17819 nasm: Illegal address access in find_cc function in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function find_cc() in asm/preproc.c that will cause denial of service, because pointers associated with skip_white_ calls are not validated. Upstream bug: https://bugzilla.nasm.us/show_bug.cgi?id=3392435 Upstream patch: http://repo.or.cz/nasm.git/commit/7524cfd91492e6e3719b959498be584a9ced13af -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1529332] New: CVE-2017-17818 nasm: Heap-based buffer over-read in paste_tokens function in asm/preproc.c
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529332 Bug ID: 1529332 Summary: CVE-2017-17818 nasm: Heap-based buffer over-read in paste_tokens function in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause denial of service, related to a while loop in paste_tokens in asm/preproc.c. Upstream bug: https://bugzilla.nasm.us/show_bug.cgi?id=3392428 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1529331] New: CVE-2017-17817 nasm: Use-after-free in pp_verror function in asm/preproc.c
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529331 Bug ID: 1529331 Summary: CVE-2017-17817 nasm: Use-after-free in pp_verror function in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_verror in asm/preproc.c that will cause denial of service. Upstream bug: https://bugzilla.nasm.us/show_bug.cgi?id=3392427 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1529330] New: CVE-2017-17816 nasm: Use-after-free in pp_getline function in asm/preproc.c
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529330 Bug ID: 1529330 Summary: CVE-2017-17816 nasm: Use-after-free in pp_getline function in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_getline in asm/preproc.c that will cause a denial of service. Upstream bug: https://bugzilla.nasm.us/show_bug.cgi?id=3392426 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1529327] New: CVE-2017-17814 nasm: use-after-free in do_directive function in asm/preproc.c
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529327 Bug ID: 1529327 Summary: CVE-2017-17814 nasm: use-after-free in do_directive function in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in do_directive in asm/preproc.c that will cause a denial of service. Upstream bug: https://bugzilla.nasm.us/show_bug.cgi?id=3392430 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1529326] New: CVE-2017-17813 nasm: use-after-free in pp_list_one_macro function in asm/preproc.c
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529326 Bug ID: 1529326 Summary: CVE-2017-17813 nasm: use-after-free in pp_list_one_macro function in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in the pp_list_one_macro function in asm/preproc.c that will cause a denial of service attack, related to mishandling of line-syntax errors. Upstream bug: https://bugzilla.nasm.us/show_bug.cgi?id=3392429 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1529319] New: CVE-2017-17812 nasm: Heap-based buffer over-read in detoken function in asm/preproc.c
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529319 Bug ID: 1529319 Summary: CVE-2017-17812 nasm: Heap-based buffer over-read in detoken function in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a denial of service attack. Upstream bug: https://bugzilla.nasm.us/show_bug.cgi?id=3392424 Upstream patch: http://repo.or.cz/nasm.git/commit/9b7ee09abfd426b99aa1ea81d19a3b2818eeabf9 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1529317] New: CVE-2017-17811 nasm: Heap-based buffer overflow in paste_tokens function in asm/preproc.c
by bugzilla＠redhat.com 16 Jan '18

16 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529317 Bug ID: 1529317 Summary: CVE-2017-17811 nasm: Heap-based buffer overflow in paste_tokens function in asm/preproc.c Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a strcpy in paste_tokens in asm/preproc.c, a similar issue to CVE-2017-11111. Upstream bug: https://bugzilla.nasm.us/show_bug.cgi?id=3392432 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1469356] New: aether-ant-tasks: Port to XMvn 3.0.0
by bugzilla＠redhat.com 11 Jan '18

11 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1469356 Bug ID: 1469356 Summary: aether-ant-tasks: Port to XMvn 3.0.0 Product: Fedora Version: rawhide Component: aether-ant-tasks Assignee: mizdebsk(a)redhat.com Reporter: mizdebsk(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com aether-ant-tasks needs porting to XMvn 3.0.0 (or retiring). aether-ant-tasks has broken dependencies in the rawhide tree: aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 958733] New: plexus-utils: suspicious shell quoting in org.codehaus.plexus.util.cli
by Red Hat Bugzilla 09 Jan '18

09 Jan '18

Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=958733 Bug ID: 958733 Summary: plexus-utils: suspicious shell quoting in org.codehaus.plexus.util.cli Product: Fedora Version: 18 Component: plexus-utils Severity: unspecified Priority: unspecified Assignee: fnasser(a)redhat.com Reporter: fweimer(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: fnasser(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Blocks: 958220 Category: --- The shell quoting logic in this package (and the org.codehaus.plexus.util.cli.shell) package looks fairly dangerous. It appears to be mostly dead code. Client code should be migrated to java.lang.ProcessBuilder. The different quoting options (single quotes, double quotes) are difficult to get right, and the reference to StringUtils is not particularly helpful because the caller has to provide the correct set of characters to be escaped, which is platform-dependent. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=JhGrfK5sg6&a=cc_unsubscribe

2 10

[Bug 1529404] New: jna-4.5.1 is available
by bugzilla＠redhat.com 05 Jan '18

05 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529404 Bug ID: 1529404 Summary: jna-4.5.1 is available Product: Fedora Version: rawhide Component: jna Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com Latest upstream release: 4.5.1 Current version/release in rawhide: 4.5.0-1.fc28 URL: https://github.com/java-native-access/jna/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1464/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1527488] New: maven-plugin-bundle-3.4.0 is available
by bugzilla＠redhat.com 05 Jan '18

05 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1527488 Bug ID: 1527488 Summary: maven-plugin-bundle-3.4.0 is available Product: Fedora Version: rawhide Component: maven-plugin-bundle Keywords: FutureFeature, Triaged Assignee: msimacek(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com Latest upstream release: 3.4.0 Current version/release in rawhide: 3.3.0-2.fc27 URL: http://repo2.maven.org/maven2/org/apache/felix/maven-bundle-plugin/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1922/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1529820] New: xz-java-1.7 is available
by bugzilla＠redhat.com 05 Jan '18

05 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1529820 Bug ID: 1529820 Summary: xz-java-1.7 is available Product: Fedora Version: rawhide Component: xz-java Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com Latest upstream release: 1.7 Current version/release in rawhide: 1.6-5.fc28 URL: http://tukaani.org/xz/java.html Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/5278/ -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1516043] New: Fedora 27 upgrade fails 100%: xmvn-launcher and aether-ant-tasks dependency problems
by bugzilla＠redhat.com 05 Jan '18

05 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1516043 Bug ID: 1516043 Summary: Fedora 27 upgrade fails 100%: xmvn-launcher and aether-ant-tasks dependency problems Product: Fedora Version: 27 Component: xmvn Severity: high Assignee: mizdebsk(a)redhat.com Reporter: gasserles(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Description of problem: Can't upgrade to Fedora 27: xmvn-launcher can't be found/installed. I'm trying to upgrade from a working Fedora 26 to Fedora 27 following instructions on this page: https://fedoraproject.org/wiki/DNF_system_upgrade Version-Release number of selected component (if applicable): xmvn-launcher-2.5.0-21.fc26.noarch (?) aether-ant-tasks-1:1.0.1-6.fc26.noarch (?) How reproducible: Use "sudo dnf system-upgrade download --refresh --releasever=27" - fails every time. see below. Steps to Reproduce: sudo dnf system-upgrade download --refresh --releasever=27 Actual results: [this-user: ~]$ sudo dnf upgrade --refresh (also tried "dnf --refresh upgrade" per below; same result) [sudo] password for this-user: Last metadata expiration check: 0:00:00 ago on Tue Nov 21 15:22:19 2017. Dependencies resolved. Nothing to do. Complete! [this-user: ~]$ sudo dnf system-upgrade download --refresh --releasever=27 Before you continue ensure that your system is fully upgraded by running "dnf --refresh upgrade". Do you want to continue [y/N]: y Last metadata expiration check: 0:00:00 ago on Tue Nov 21 15:22:59 2017. Error: Problem: package aether-ant-tasks-1:1.0.1-6.fc26.noarch requires xmvn-launcher, but none of the providers can be installed - xmvn-launcher-2.5.0-21.fc26.noarch does not belong to a distupgrade repository - problem with installed package aether-ant-tasks-1:1.0.1-6.fc26.noarch [this-user: ~]$ -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1492259] New: maven-surefire-2.20.1 is available
by bugzilla＠redhat.com 05 Jan '18

05 Jan '18

https://bugzilla.redhat.com/show_bug.cgi?id=1492259 Bug ID: 1492259 Summary: maven-surefire-2.20.1 is available Product: Fedora Version: rawhide Component: maven-surefire Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com Latest upstream release: 2.20.1 Current version/release in rawhide: 2.20-1.fc28 URL: http://repo2.maven.org/maven2/org/apache/maven/surefire/surefire/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1944/ -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1529892] New: stapler: FTBFS in Fedora rawhide
by bugzilla＠redhat.com 30 Dec '17

30 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1529892 Bug ID: 1529892 Summary: stapler: FTBFS in Fedora rawhide Product: Fedora Version: rawhide Component: stapler Assignee: msrb(a)redhat.com Reporter: cbvms123(a)googlemail.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Description of problem: Package stapler fails to build from source in Fedora rawhide. Version-Release number of selected component (if applicable): 1.242-2.fc26 Steps to Reproduce: koji build --scratch f28 stapler-1.242-2.fc26.src.rpm Additional info: This package is tracked by Koschei. See: http://apps.fedoraproject.org/koschei/package/stapler Analysis so far shows a version mismatch for dom4j library. While the upstream package uses a forked version of dom4j, the package uses the dom4j library from the distribution. Since the dom4j was upgraded to version 2.0 in the distribution this pakages cannot build anymore. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1465573] CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
by bugzilla＠redhat.com 28 Dec '17

28 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1465573 Fabio Olive Leite <fleite(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo? |needinfo?(bkundal(a)redhat.co |needinfo?(bkundal(a)redhat.co |m) |m) | --- Comment #23 from Fabio Olive Leite <fleite(a)redhat.com> --- Setting needinfo to Bharti Kundal so that she sees it. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1465573] CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
by bugzilla＠redhat.com 28 Dec '17

28 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1465573 Yogendra Jog <yjog(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |yjog(a)redhat.com Flags| |needinfo?(bkundal(a)redhat.co | |m) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1465573] CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
by bugzilla＠redhat.com 28 Dec '17

28 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1465573 Salvatore Bonaccorso <carnil(a)debian.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |carnil(a)debian.org Flags| |needinfo? --- Comment #21 from Salvatore Bonaccorso <carnil(a)debian.org> --- Hi Would it be possible to indicate where the issue was fixed? In Debian we ship libhibernate-validator-java and we would like to clarify if/how we are affected by the issue. Is there any furher reference? Thank you already! Regards, Salvatore -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1529328] CVE-2017-17815 nasm: Illegal address access in is_mmacro function in asm/preproc.c
by bugzilla＠redhat.com 27 Dec '17

27 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1529328 Pedro Sampaio <psampaio(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1529336 --- Comment #1 from Pedro Sampaio <psampaio(a)redhat.com> --- Created nasm tracking bugs for this issue: Affects: fedora-all [bug 1529336] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1529336 [Bug 1529336] CVE-2017-17810 CVE-2017-17811 CVE-2017-17812 CVE-2017-17813 CVE-2017-17814 CVE-2017-17815 CVE-2017-17816 CVE-2017-17817 CVE-2017-17818 CVE-2017-17819 CVE-2017-17820 nasm: various flaws [fedora-all] -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1508110] CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
by bugzilla＠redhat.com 26 Dec '17

26 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1528565 Jason Shepherd <jshepherd(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1523223 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1462702 Jason Shepherd <jshepherd(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|1523223 | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1528565] CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-15095)
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

1 0

[Bug 1514765] New: easymock-3.5.1 is available
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1514765 Bug ID: 1514765 Summary: easymock-3.5.1 is available Product: Fedora Version: rawhide Component: easymock Keywords: FutureFeature, Triaged Assignee: msimacek(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, ctubbsii(a)fedoraproject.org, dbhole(a)redhat.com, fnasser(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com Latest upstream release: 3.5.1 Current version/release in rawhide: 3.5-1.fc28 URL: http://www.easymock.org Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/649/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1526591] New: jenkins: Random failures to initialize the setup wizard on startup
by bugzilla＠redhat.com 22 Dec '17

22 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1526591 Bug ID: 1526591 Summary: jenkins: Random failures to initialize the setup wizard on startup Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com A race condition during Jenkins startup could result in the wrong order of execution of commands during initialization. On Jenkins 2.81 and newer, including LTS 2.89.1, this could in rare cases (estimated less than 20% of new instances) result in failure to initialize the setup wizard on the first startup. This may result in the security settings not being set to their usual strict default External references: https://jenkins.io/security/advisory/2017-12-14/ -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1506612] CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-7525)
by bugzilla＠redhat.com 20 Dec '17

20 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1506612 Pavel Polischouk <pavelp(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1527999, 1527998 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1506612] CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-7525)
by bugzilla＠redhat.com 20 Dec '17

20 Dec '17

1 0

[Bug 1501529] CVE-2017-12629 Solr: Code execution via entity expansion
by bugzilla＠redhat.com 19 Dec '17

19 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1501529 Bharti Kundal <bkundal(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1527613 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1527538] New: Tomcat is missing from the epel7 repository
by bugzilla＠redhat.com 19 Dec '17

19 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1527538 Bug ID: 1527538 Summary: Tomcat is missing from the epel7 repository Product: Fedora EPEL Version: epel7 Component: tomcat Assignee: mmathesi(a)redhat.com Reporter: d.reade(a)reades.co.uk QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com, me(a)coolsvap.net, mmathesi(a)redhat.com Tomcat 7.0.82 is currently available from the el6 repository. Can it be made available under the epel7 repository too please? -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1508110] CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
by bugzilla＠redhat.com 19 Dec '17

19 Dec '17

1 0

[Bug 1506612] CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-7525)
by bugzilla＠redhat.com 18 Dec '17

18 Dec '17

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 14 Dec '17

14 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1462702 --- Comment #53 from Jason Shepherd <jshepherd(a)redhat.com> --- Statement: This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time: Candlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected. However as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked. JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: https://access.redhat.com/solutions/3279231 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1506612] CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-7525)
by bugzilla＠redhat.com 14 Dec '17

14 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1506612 --- Comment #23 from Jason Shepherd <jshepherd(a)redhat.com> --- Statement: This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time: Candlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected. However as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked. JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: https://access.redhat.com/solutions/3279231 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1501529] CVE-2017-12629 Solr: Code execution via entity expansion
by bugzilla＠redhat.com 14 Dec '17

14 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1501529 Huzaifa S. Sidhpurwala <huzaifas(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1525800 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1501529] CVE-2017-12629 Solr: Code execution via entity expansion
by bugzilla＠redhat.com 14 Dec '17

14 Dec '17

1 0

[Bug 1506612] CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-7525)
by bugzilla＠redhat.com 14 Dec '17

14 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1506612 --- Comment #21 from Jason Shepherd <jshepherd(a)redhat.com> --- Statement: EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on EAP 7.x is available here: https://access.redhat.com/solutions/3279231 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 14 Dec '17

14 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1462702 --- Comment #51 from Jason Shepherd <jshepherd(a)redhat.com> --- Statement: EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on EAP 7.x is available here: https://access.redhat.com/solutions/3279231 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1465573] CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
by bugzilla＠redhat.com 13 Dec '17

13 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1465573 --- Comment #20 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Via RHSA-2017:3458 https://access.redhat.com/errata/RHSA-2017:3458 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 13 Dec '17

13 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1462702 --- Comment #49 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Via RHSA-2017:3458 https://access.redhat.com/errata/RHSA-2017:3458 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1465573] CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
by bugzilla＠redhat.com 13 Dec '17

13 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1465573 --- Comment #19 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Via RHSA-2017:3455 https://access.redhat.com/errata/RHSA-2017:3455 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 13 Dec '17

13 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1462702 --- Comment #48 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Via RHSA-2017:3455 https://access.redhat.com/errata/RHSA-2017:3455 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1465573] CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
by bugzilla＠redhat.com 13 Dec '17

13 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1465573 --- Comment #18 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Via RHSA-2017:3454 https://access.redhat.com/errata/RHSA-2017:3454 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 13 Dec '17

13 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1462702 --- Comment #47 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Via RHSA-2017:3454 https://access.redhat.com/errata/RHSA-2017:3454 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1465573] CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
by bugzilla＠redhat.com 13 Dec '17

13 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1465573 --- Comment #17 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2017:3456 https://access.redhat.com/errata/RHSA-2017:3456 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 13 Dec '17

13 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1462702 --- Comment #46 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2017:3456 https://access.redhat.com/errata/RHSA-2017:3456 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1501529] CVE-2017-12629 Solr: Code execution via entity expansion
by bugzilla＠redhat.com 13 Dec '17

13 Dec '17

1 0

[Bug 1501529] CVE-2017-12629 Solr: Code execution via entity expansion
by bugzilla＠redhat.com 13 Dec '17

13 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1501529 Stefan Cornelius <scorneli(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |ERRATA Last Closed| |2017-12-13 04:40:19 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1375941] CVE-2016-5725 jsch: ChannelSftp path traversal vulnerability
by bugzilla＠redhat.com 12 Dec '17

12 Dec '17

1 0

[Bug 1375941] CVE-2016-5725 jsch: ChannelSftp path traversal vulnerability
by bugzilla＠redhat.com 12 Dec '17

12 Dec '17

1 0

[Bug 1375941] CVE-2016-5725 jsch: ChannelSftp path traversal vulnerability
by bugzilla＠redhat.com 12 Dec '17

12 Dec '17

1 0

[Bug 1375941] CVE-2016-5725 jsch: ChannelSftp path traversal vulnerability
by bugzilla＠redhat.com 12 Dec '17

12 Dec '17

1 0

[Bug 1375941] CVE-2016-5725 jsch: path traversal vulnerability
by bugzilla＠redhat.com 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1375941 --- Comment #8 from Tomas Hoger <thoger(a)redhat.com> --- Created attachment 1366981 --> https://bugzilla.redhat.com/attachment.cgi?id=1366981&action=edit Upstream fix There does not seem to be any public source repository for this project, hence attaching the relevant part of the diff between 0.1.53 and 0.1.54. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1375941] CVE-2016-5725 jsch: path traversal vulnerability
by bugzilla＠redhat.com 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1375941 Tomas Hoger <thoger(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version|jsch 0.1.53 |jsch 0.1.54 --- Comment #7 from Tomas Hoger <thoger(a)redhat.com> --- This was fixed upstream in version 0.1.54, as noted in the upstream release announcement: https://sourceforge.net/p/jsch/mailman/message/35318093/ -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1501529] CVE-2017-12629 Solr: Code execution via entity expansion
by bugzilla＠redhat.com 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1501529 --- Comment #35 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Via RHSA-2017:3452 https://access.redhat.com/errata/RHSA-2017:3452 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1501529] CVE-2017-12629 Solr: Code execution via entity expansion
by bugzilla＠redhat.com 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1501529 --- Comment #34 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Via RHSA-2017:3451 https://access.redhat.com/errata/RHSA-2017:3451 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1268242] New: solr-5.3.1 is available
by Red Hat Bugzilla 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1268242 Bug ID: 1268242 Summary: solr-5.3.1 is available Product: Fedora Version: rawhide Component: solr Assignee: puntogil(a)libero.it Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Latest upstream release: 5.3.1 Current version/release in rawhide: 5.3.0-1.fc24 URL: http://www.apache.org/dist/lucene/solr Please, consider upgrading -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=FSln2KmW6z&a=cc_unsubscribe

2 32

[Bug 1327883] New: spatial4j-0.6 is available
by Red Hat Bugzilla 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1327883 Bug ID: 1327883 Summary: spatial4j-0.6 is available Product: Fedora Version: rawhide Component: spatial4j Assignee: puntogil(a)libero.it Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Latest upstream release: 0.6 Current version/release in rawhide: 0.5.0-3.fc25 URL: https://github.com/locationtech/spatial4j/tags -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1335748] New: jenkins-xstream: bundles XStream
by Red Hat Bugzilla 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1335748 Bug ID: 1335748 Summary: jenkins-xstream: bundles XStream Product: Fedora Version: rawhide Component: jenkins-xstream Assignee: msrb(a)redhat.com Reporter: mizdebsk(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, msrb(a)redhat.com Description of problem: Package jenknis-xstream bundles XStream library: /usr/share/java/jenkins-xstream/xstream.jar Version-Release number of selected component (if applicable): jenkins-xstream-1.4.7-8.jenkins1.fc24.noarch -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1346139] New: Keyboard not working when entering "console" mode
by Red Hat Bugzilla 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1346139 Bug ID: 1346139 Summary: Keyboard not working when entering "console" mode Product: Fedora Version: 24 Component: sbt Assignee: willb(a)redhat.com Reporter: rvernica(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, s(a)shk.io, willb(a)redhat.com Description of problem: When entering the "console" mode of sbt, the keyboard locks and only accepted key press is Ctrl-C which exists the "console" mode. Version-Release number of selected component (if applicable): > cat /etc/fedora-release Fedora release 24 (Twenty Four) > sudo dnf info sbt Last metadata expiration check: 1:31:17 ago on Mon Jun 13 21:39:01 2016. Installed Packages Name : sbt Arch : noarch Epoch : 0 Version : 0.13.1 Release : 8.fc24.1 Size : 21 M Repo : @System From repo : @commandline Summary : The simple build tool for Scala and Java projects URL : http://www.scala-sbt.org License : BSD Description : sbt is the simple build tool for Scala and Java projects. How reproducible: Always Steps to Reproduce: 1. Start "sbt" and then type "console" OR start "sbt console" 2. Pressing any key on the keyboard shows no output on the terminal 3. Pressing Ctrl-C stops "sbt" > sbt console [info] Set current project to rares (in build file:/home/.../) [info] Updating {file:/home/.../}... [info] Resolving org.scala-lang#scala-reflect;2.10.4 ... [info] Done updating. [info] Starting scala interpreter... [info] Welcome to Scala version 2.10.4 (OpenJDK 64-Bit Server VM, Java 1.8.0_91). Type in expressions to have them evaluated. Type :help for more information. scala> % Actual results: Keyboard does not work. Pressing any key shows no output. Expected results: Keyboard should work. Pressing any key should print that key on the terminal. Additional info: This has been reported in the past but closed due to EOL: https://bugzilla.redhat.com/show_bug.cgi?id=1091711 -- You are receiving this mail because: You are on the CC list for the bug.

2 5

[Bug 1405223] New: fop invocation failure.
by Red Hat Bugzilla 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1405223 Bug ID: 1405223 Summary: fop invocation failure. Product: Fedora Version: 25 Component: fop Assignee: r.landmann(a)redhat.com Reporter: stefan(a)seefeld.name QA Contact: extras-qa(a)fedoraproject.org CC: c.david86(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, rhbugs(a)n-dimensional.de, r.landmann(a)redhat.com Description of problem: Each time I invoke `fop` to build a PDF I get this exception: $ fop reference.fo reference.pdf Exception in thread "main" java.lang.NoClassDefFoundError: org/apache/xml/serializer/OutputPropertiesFactory at org.apache.xalan.templates.OutputProperties.<init>(OutputProperties.java:84) at org.apache.xalan.transformer.TransformerIdentityImpl.<init>(TransformerIdentityImpl.java:88) at org.apache.xalan.processor.TransformerFactoryImpl.newTransformer(TransformerFactoryImpl.java:827) at org.apache.fop.cli.InputHandler.transformTo(InputHandler.java:264) at org.apache.fop.cli.InputHandler.renderTo(InputHandler.java:115) at org.apache.fop.cli.Main.startFOP(Main.java:186) at org.apache.fop.cli.Main.main(Main.java:216) Caused by: java.lang.ClassNotFoundException: org.apache.xml.serializer.OutputPropertiesFactory at java.net.URLClassLoader.findClass(URLClassLoader.java:381) at java.lang.ClassLoader.loadClass(ClassLoader.java:424) at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:331) at java.lang.ClassLoader.loadClass(ClassLoader.java:357) ... 7 more This seems to hint at missing dependencies (i.e., prerequisite java packages) Version-Release number of selected component (if applicable): fop.noarch 2.0-3.fc24 (Also, there doesn't appear to be any up-to-date fop package for Fedora 25 !) -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1098424] New: tycho: Java class bundling/"static linking"
by Red Hat Bugzilla 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1098424 Bug ID: 1098424 Summary: tycho: Java class bundling/"static linking" Product: Fedora Version: rawhide Component: tycho Assignee: rgrunber(a)redhat.com Reporter: fweimer(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, rgrunber(a)redhat.com Blocks: 1098237 tycho-0.20.0-6.fc21.noarch bundles many class files which are also available from other Fedora packages. Here are a few examples: /usr/share/java/tycho/org.eclipse.tycho.surefire.junit.jar contains org/apache/maven/surefire/common/junit3/JUnit3Reflector, also part of maven-surefire-provider-junit-0:2.17-1.fc21.noarch. /usr/share/java/tycho/org.eclipse.tycho.surefire.junit4.jar contains org/apache/maven/surefire/common/junit3/JUnit3TestChecker, also from maven-surefire-provider-junit-0:2.17-1.fc21.noarch. /usr/share/java/tycho/org.eclipse.tycho.surefire.osgibooter.jar contains the class org/codehaus/plexus/util/AbstractScanner, which is part of plexus-utils-3.0.16-2.fc21.noarch. /usr/share/java/tycho/tycho-bundles-external.zip contains org/apache/commons/logging/Log from apache-commons-logging-1.1.3-11.fc21.noarch, org/apache/commons/codec/BinaryDecoder from apache-commons-codec-1.9-2.fc21.noarch, org/apache/http/auth/AUTH from httpcomponents-client-4.3.3-1.fc21.noarch, org/apache/http/ConnectionClosedException from httpcomponents-core-4.3.2-1.fc21.noarch, org/sat4j/AbstractLauncher from sat4j-2.3.5-3.fc21.noarch. It seems that at least some of these class files are copied from build dependencies into the JAR files of the tycho RPM. Such bundling/static linking is against the Fedora packaging guidelines, specifically <http://fedoraproject.org/wiki/Packaging:No_Bundled_Libraries>. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1098237 [Bug 1098237] Java "static linking"/class bundling in Fedora -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=Ws5wsBGzEs&a=cc_unsubscribe

2 8

[Bug 1234368] New: gem-maven-plugin failed to resolve jruby stdlib artifact
by Red Hat Bugzilla 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1234368 Bug ID: 1234368 Summary: gem-maven-plugin failed to resolve jruby stdlib artifact Product: Fedora Version: rawhide Component: jruby-maven-plugins Assignee: msrb(a)redhat.com Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com [ERROR] Failed to execute goal de.saumya.mojo:gem-maven-plugin:1.0.10:initialize (default) on project polyglot-ruby: failed to resolve jruby stdlib artifact -> [Help 1] -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=edDONMJNM7&a=cc_unsubscribe

2 10

[Bug 1222940] New: tesla-polyglot: build ruby module
by Red Hat Bugzilla 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1222940 Bug ID: 1222940 Summary: tesla-polyglot: build ruby module Product: Fedora Version: rawhide Component: tesla-polyglot Assignee: puntogil(a)libero.it Reporter: msrb(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Description of problem: Please build also ruby module. It's needed by jruby-maven-plugins. Thanks. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AELku4xSeb&a=cc_unsubscribe

2 9

[Bug 1255806] New: curator-2.8.0 is available
by Red Hat Bugzilla 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1255806 Bug ID: 1255806 Summary: curator-2.8.0 is available Product: Fedora Version: rawhide Component: curator Assignee: tstclair(a)redhat.com Reporter: puntogil(a)libero.it QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, tstclair(a)redhat.com Latest upstream release: 2.8.0 Current version/release in rawhide: 2.2.0-5.fc23 URL: http://www.apache.org/dist/curator Please, consider upgrading Build/Requires for hadoop-2.7.1 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=huhB7Z9bAI&a=cc_unsubscribe

2 10

[Bug 1258695] New: antlr C parser generator is broken in 3.5
by Red Hat Bugzilla 12 Dec '17

12 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1258695 Bug ID: 1258695 Summary: antlr C parser generator is broken in 3.5 Product: Fedora Version: 22 Component: antlr3 Severity: high Assignee: walters(a)redhat.com Reporter: orion(a)cora.nwra.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com, projects.rg(a)smart.ms, walters(a)redhat.com, xjakub(a)fi.muni.cz Description of problem: The C parser generator is broken in 3.5. See upstream report https://github.com/antlr/antlr3/issues/175 Version-Release number of selected component (if applicable): 3.5.2 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=W1iZweoIpq&a=cc_unsubscribe _______________________________________________ java-sig-commits mailing list java-sig-commits(a)lists.fedoraproject.org http://lists.fedoraproject.org/postorius/java-sig-commits@lists.fedoraproje…

2 6

[Bug 1524587] New: CVE-2016-4216 xmpcore: XXE resulting in information disclosure [epel-7]
by bugzilla＠redhat.com 11 Dec '17

11 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1524587 Bug ID: 1524587 Summary: CVE-2016-4216 xmpcore: XXE resulting in information disclosure [epel-7] Product: Fedora EPEL Version: epel7 Component: xmpcore Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: cedric.olivier(a)free.fr Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: cedric.olivier(a)free.fr, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-7. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1410481] CVE-2017-2582 picketlink, keycloak: SAML request parser replaces special strings with system properties
by bugzilla＠redhat.com 11 Dec '17

11 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1410481 Bharti Kundal <bkundal(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|1520314 | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 11 Dec '17

11 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1462702 Bharti Kundal <bkundal(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks|1520314 | -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1524540] New: CVE-2017-17383 jenkins: XSS via a crafted tool name in a job configuration form
by bugzilla＠redhat.com 11 Dec '17

11 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1524540 Bug ID: 1524540 Summary: CVE-2017-17383 jenkins: XSS via a crafted tool name in a job configuration form Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin, aka SECURITY-624. External References: https://jenkins.io/security/advisory/2017-12-05/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1524469] New: CVE-2017-15702 qpid-java: Authentication vulnerability on HTTP ports
by bugzilla＠redhat.com 11 Dec '17

11 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1524469 Bug ID: 1524469 Summary: CVE-2017-15702 qpid-java: Authentication vulnerability on HTTP ports Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: bcourt(a)redhat.com, bhu(a)redhat.com, bkearney(a)redhat.com, esammons(a)redhat.com, iboverma(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jmatthew(a)redhat.com, jross(a)redhat.com, kpalko(a)redhat.com, matt(a)redhat.com, mcressma(a)redhat.com, messaging-bugs(a)redhat.com, mmccune(a)redhat.com, mrike(a)redhat.com, ohadlevy(a)redhat.com, puntogil(a)libero.it, rchan(a)redhat.com, rrajasek(a)redhat.com, tjay(a)redhat.com, tsanders(a)redhat.com, williams(a)redhat.com If the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to the HTTP port into using an authentication provider that was configured on a different port. The attacker still needs valid credentials with the authentication provider on the spoofed port. This becomes an issue when the spoofed port has weaker authentication protection (e.g., anonymous access, default accounts) and is normally protected by firewall rules or similar which can be circumvented by this vulnerability. AMQP ports are not affected. Versions 6.0.0 and newer are not affected. External References: https://qpid.apache.org/cves/CVE-2017-15702.html Upstream issue: https://issues.apache.org/jira/browse/QPID-8039 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1523883] New: bcel-6.2 is available
by bugzilla＠redhat.com 11 Dec '17

11 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1523883 Bug ID: 1523883 Summary: bcel-6.2 is available Product: Fedora Version: rawhide Component: bcel Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: agrimm(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, richardfearn(a)gmail.com Latest upstream release: 6.2 Current version/release in rawhide: 6.1-2.fc28 URL: http://www.apache.org/dist/commons/bcel/source/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/171/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 11 Dec '17

11 Dec '17

1 0

[Bug 1506612] CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list ( incomplete fix for CVE-2017-7525)
by bugzilla＠redhat.com 08 Dec '17

08 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1506612 --- Comment #18 from Kurt Seifried <kseifried(a)redhat.com> --- Statement: This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellitw 6.x. However the affected code is NOT used at this time: Candlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected. However as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 08 Dec '17

08 Dec '17

https://bugzilla.redhat.com/show_bug.cgi?id=1462702 --- Comment #41 from Kurt Seifried <kseifried(a)redhat.com> --- Statement: This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellitw 6.x. However the affected code is NOT used at this time: Candlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected. However as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked. -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 08 Dec '17

08 Dec '17

1 0

[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla＠redhat.com 08 Dec '17

08 Dec '17

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits December 2017