[Bug 1472494] New: jna no longer provides osgi(com.sun.jna)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1472494
Bug ID: 1472494
Summary: jna no longer provides osgi(com.sun.jna)
Product: Fedora
Version: rawhide
Component: jna
Assignee: mizdebsk(a)redhat.com
Reporter: tdawson(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
lfarkas(a)lfarkas.org, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, walters(a)redhat.com
Description of problem:
jna-4.4.0-4 no longer provides osgi(com.sun.jna). this is problem because
jna-contrib requires it.
Version-Release number of selected component (if applicable):
jna-4.4.0-4.fc27
How reproducible:
100%
Steps to Reproduce:
1.dnf install jna-contrib
2.
3.
Actual results:
Last metadata expiration check: 0:00:30 ago on Tue 18 Jul 2017 06:01:47 PM CDT.
Error:
Problem: conflicting requests
- nothing provides osgi(com.sun.jna) needed by
jna-contrib-4.4.0-4.fc27.noarch
Expected results:
Installing:
jna-contrib noarch 4.4.0-4.fc26
Installing dependencies:
jna x86_64 4.4.0-4.fc26
Additional info:
You can see the difference in the provdes by looking at the info pages for the
builds.
jna-4.4.0-4.fc27 (not working)
https://koji.fedoraproject.org/koji/rpminfo?rpmID=10178780
jna-4.4.0-2.fc27 (working)
https://koji.fedoraproject.org/koji/rpminfo?rpmID=10092224
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
Broken dependencies: aether-ant-tasks
by buildsys@fedoraproject.org
aether-ant-tasks has broken dependencies in the rawhide tree:
On x86_64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On armhfp:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64le:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On aarch64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On i386:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
Please resolve this as soon as possible.
6 years, 9 months
Broken dependencies: jna
by buildsys@fedoraproject.org
jna has broken dependencies in the rawhide tree:
On x86_64:
jna-contrib-4.4.0-4.fc27.noarch requires osgi(com.sun.jna)
On armhfp:
jna-contrib-4.4.0-4.fc27.noarch requires osgi(com.sun.jna)
On ppc64le:
jna-contrib-4.4.0-4.fc27.noarch requires osgi(com.sun.jna)
On aarch64:
jna-contrib-4.4.0-4.fc27.noarch requires osgi(com.sun.jna)
On ppc64:
jna-contrib-4.4.0-4.fc27.noarch requires osgi(com.sun.jna)
On i386:
jna-contrib-4.4.0-4.fc27.noarch requires osgi(com.sun.jna)
Please resolve this as soon as possible.
6 years, 9 months
[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1462702
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|70714,reported=20170616,sou |70714,reported=20170616,sou
|rce=researcher,cvss3=8.1/CV |rce=researcher,cvss3=8.1/CV
|SS:3.0/AV:N/AC:H/PR:N/UI:N/ |SS:3.0/AV:N/AC:H/PR:N/UI:N/
|S:U/C:H/I:H/A:H,cwe=CWE-20, |S:U/C:H/I:H/A:H,cwe=CWE-20,
|amq-6/jackson-databind=affe |amq-6/jackson-databind=affe
|cted,jdg-7/jackson-databind |cted,jdg-7/jackson-databind
|=new,jdv-6/jackson-databind |=new,jdv-6/jackson-databind
|=affected,eap-7/jackson-dat |=affected,eap-7/jackson-dat
|abind=affected,bpms-6/jacks |abind=affected,bpms-6/jacks
|on-databind=affected,brms-6 |on-databind=affected,brms-6
|/jackson-databind=affected, |/jackson-databind=affected,
|fuse-6/jackson-databind=aff |fuse-6/jackson-databind=aff
|ected,openshift-enterprise- |ected,openshift-enterprise-
|2/jackson-databind=wontfix, |2/jackson-databind=wontfix,
|rhn_satellite_6/jackson-dat |rhn_satellite_6/jackson-dat
|abind=affected,rhmap-4/jack |abind=affected,rhmap-4/jack
|son-databind=notaffected,sa |son-databind=notaffected,sa
|m-1/jackson-databind=wontfi |m-1/jackson-databind=wontfi
|x,rhev-m-3/jasperreports-se |x,rhev-m-3/jasperreports-se
|rver-pro=wontfix,rhev-m-4/e |rver-pro=wontfix,rhev-m-4/e
|ap7-jackson-databind=affect |ap7-jackson-databind=affect
|ed,rhscl-2/rh-eclipse46-jac |ed,rhscl-2/rh-eclipse46-jac
|kson-databind=new,fedora-al |kson-databind=new,fedora-al
|l/jackson-databind=affected |l/jackson-databind=affected
|,jon-3/Core |,jon-3/Core
|Server=affected,eap-6/jacks |Server=notaffected,eap-6/ja
|on-databind=affected |ckson-databind=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1470536] New: Simple Lagom example is not working under Fedora 26
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1470536
Bug ID: 1470536
Summary: Simple Lagom example is not working under Fedora 26
Product: Fedora
Version: 26
Component: sbt
Assignee: willb(a)redhat.com
Reporter: aannoaanno(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, s(a)shk.io, willb(a)redhat.com
Description of problem:
Simple Lagom example is not working under Fedora 26 (and Fedora 25). Example is
known to work under Win10 and Ubuntu 17.04/zesty.
Lagom is a scala (akka, sbt) based microservice framework running on top of the
Java VM (https://www.lagomframework.com). If the lagom example is not working,
it is very likely (but not tested) that akka is not working.
I've choosen sbt as problematic component. However, I rather think that this is
unlikely. I suspect that there is a problem with fedora's security settings.
But the example has not worked with firewall and selinux disabled (see below).
Version-Release number of selected component (if applicable):
lagom version is 1.3.4
How reproducible:
Always
Steps to Reproduce:
1. Clone the lagon example from https://github.com/aanno/lagom-hello. This is a
minimal lagom example as described in
https://www.lagomframework.com/get-started-scala.html without any
modifications.
2. You need an installed sbt (and, of course a Java SDK)
3. cd lagom-hello
4. /usr/share/sbt/bin/sbt runAll
Actual results:
sbt logging output indicating the error:
[warn] a.c.s.ShardRegion - Trying to register to coordinator at
[Some(ActorSelection[Anchor(akka://lagom-hello-impl-application/),
Path(/system/sharding/kafkaProducer-greetingsCoordinator/singleton/coordinator)])],
but no acknowledgement. Total [1] buffered messages.
[warn] a.c.s.ShardRegion - Trying to register to coordinator at
[Some(ActorSelection[Anchor(akka://lagom-hello-impl-application/),
Path(/system/sharding/kafkaProducer-greetingsCoordinator/singleton/coordinator)])],
but no acknowledgement. Total [1] buffered messages.
[warn] a.c.s.ShardRegion - Trying to register to coordinator at
[Some(ActorSelection[Anchor(akka://lagom-hello-impl-application/),
Path(/system/sharding/kafkaProducer-greetingsCoordinator/singleton/coordinator)])],
but no acknowledgement. Total [1] buffered messages.
[warn] a.c.s.ShardRegion - Trying to register to coordinator at
[Some(ActorSelection[Anchor(akka://lagom-hello-impl-application/),
Path(/system/sharding/kafkaProducer-greetingsCoordinator/singleton/coordinator)])],
but no acknowledgement. Total [1] buffered messages.
[warn] a.c.s.ShardRegion - Retry request for shard [singleton] homes from
coordinator at
[Actor[akka://lagom-hello-impl-application/system/sharding/kafkaProducer-greetingsCoordinator/singleton/coordinator#183754478]].
[1] buffered messages.
This output is not there if the example is working (i.e. on Win10, and Ubuntu).
Expected results:
Directing browser to http://localhost:9000/api/hello/World will display 'Hello,
word!'
Additional info:
First reported to the lagom list at
https://groups.google.com/forum/#!topic/lagom-framework/kpNCDCQgQp8 .
I also turned on firewall logging - but couldn't find any hint in the logs.
I disabled the firewall (systemctl stop firewalld) and selinux altogether
(setenforce 0) - but the problem is still there.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1443409] New: jenkins-task-reactor: Running arbitrary Groovy code in Jenskin JVM via Reactor Event ( SECURITY-487)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1443409
Bug ID: 1443409
Summary: jenkins-task-reactor: Running arbitrary Groovy code in
Jenskin JVM via Reactor Event (SECURITY-487)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, kseifried(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
tdawson(a)redhat.com
Reactor plugin allows users with Job/Configure permission to run arbitrary
Groovy code inside the Jenkins JVM by defining a Reactor Script that will be
run when a Reactor Event triggers, effectively elevating privileges to
Overall/Run Scripts.
Affects all versions.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1372124] CVE-2016-6347 RESTEasy: Use of the default exception handler in RESTEasy can lead to reflected XSS attack
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1372124
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |lzap(a)redhat.com,
| |mhulan(a)redhat.com,
| |tbrisker(a)redhat.com
Whiteboard|impact=moderate,public=2016 |impact=moderate,public=2016
|0901,reported=20160829,sour |0901,reported=20160829,sour
|ce=researcher,cvss2=4.3/AV: |ce=researcher,cvss2=4.3/AV:
|N/AC:M/Au:N/C:N/I:P/A:N,cvs |N/AC:M/Au:N/C:N/I:P/A:N,cvs
|s3=5.4/CVSS:3.0/AV:N/AC:H/P |s3=5.4/CVSS:3.0/AV:N/AC:H/P
|R:N/UI:N/S:C/C:L/I:L/A:N,cw |R:N/UI:N/S:C/C:L/I:L/A:N,cw
|e=CWE-20,eap-7/REST=affecte |e=CWE-20,eap-7/REST=affecte
|d,fedora-all/resteasy=affec |d,fedora-all/resteasy=affec
|ted,eap-6/RESTEasy=notaffec |ted,eap-6/RESTEasy=notaffec
|ted,eap-5/jbossas=wontfix,b |ted,eap-5/jbossas=wontfix,b
|pms-6/Build and |pms-6/Build and
|Assembly=notaffected,brms-6 |Assembly=notaffected,brms-6
|/Build and |/Build and
|Assembly=notaffected,jdg-6/ |Assembly=notaffected,jdg-6/
|Build=new,jdv-6/Productizat |Build=new,jdv-6/Productizat
|ion=notaffected,brms-5/Secu |ion=notaffected,brms-5/Secu
|rity=wontfix,soap-5/Securit |rity=wontfix,soap-5/Securit
|y=wontfix,fsw-6/SwitchYard= |y=wontfix,fsw-6/SwitchYard=
|notaffected,fuse-6/SwitchYa |notaffected,fuse-6/SwitchYa
|rd=affected,jon-3/REST=wont |rd=affected,jon-3/REST=wont
|fix,jpp-6/Requirements=new, |fix,jpp-6/Requirements=new,
|rhsso-7/Core=new,rhev-m-3/v |rhsso-7/Core=new,rhev-m-3/v
|dsm-jsonrpc-java=new,rhn_sa |dsm-jsonrpc-java=new,rhn_sa
|tellite_6/Security=new,sam- |tellite_6/Security=affected
|1/katello=new |,sam-1/katello=new
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
Broken dependencies: aether-ant-tasks
by buildsys@fedoraproject.org
aether-ant-tasks has broken dependencies in the rawhide tree:
On x86_64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On armhfp:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64le:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On aarch64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On i386:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
Please resolve this as soon as possible.
6 years, 9 months
[Bug 1462702] CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1462702
Hooman Broujerdi <hghasemb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Group|security, qe_staff |
CC| |abhgupta(a)redhat.com,
| |java-sig-commits(a)lists.fedo
| |raproject.org,
| |puntogil(a)libero.it,
| |Rhev-m-bugs(a)redhat.com,
| |tiwillia(a)redhat.com
Summary|EMBARGOED CVE-2017-7525 |CVE-2017-7525
|jackson-databind: |jackson-databind:
|Deserialization |Deserialization
|vulnerability via readValue |vulnerability via readValue
|method of ObjectMapper |method of ObjectMapper
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months