[Bug 1413466] CVE-2016-6814 Apache Groovy: Remote code execution via deserialization
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1413466
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|70114,reported=20170112,sou |70114,reported=20170112,sou
|rce=internet,cvss3=9.6/CVSS |rce=internet,cvss3=9.6/CVSS
|:3.0/AV:N/AC:L/PR:N/UI:R/S: |:3.0/AV:N/AC:L/PR:N/UI:R/S:
|C/C:H/I:H/A:H,amq-6/groovy= |C/C:H/I:H/A:H,amq-6/groovy=
|affected,jdv-6/groovy=affec |affected,jdv-6/groovy=affec
|ted/impact=moderate/cvss3=8 |ted/impact=moderate/cvss3=8
|.3/CVSS:3.0/AV:N/AC:H/PR:N/ |.3/CVSS:3.0/AV:N/AC:H/PR:N/
|UI:R/S:C/C:H/I:H/A:H,eap-5/ |UI:R/S:C/C:H/I:H/A:H,eap-5/
|groovy=wontfix,brms-5/groov |groovy=wontfix,brms-5/groov
|y=wontfix,soap-5/groovy=won |y=wontfix,soap-5/groovy=won
|tfix,eds-5/groovy=wontfix,f |tfix,eds-5/groovy=wontfix,f
|sw-6/camel=affected,fuse-6/ |sw-6/camel=affected,fuse-6/
|camel=affected,jon-3/groovy |camel=affected,jon-3/groovy
|=notaffected,epp-5/groovy=n |=notaffected,epp-5/groovy=n
|ew,openshift-enterprise-2/j |ew,openshift-enterprise-2/j
|enkins=wontfix,rhev-m-3/jas |enkins=wontfix,rhev-m-3/jas
|perreports-server-pro=wontf |perreports-server-pro=wontf
|ix,rhel-7/groovy=affected,r |ix,rhel-7/groovy=affected,r
|hn_satellite_6/groovy=new,r |hn_satellite_6/groovy=affec
|hscl-2/rh-maven33-groovy=ne |ted,rhscl-2/rh-maven33-groo
|w,fedora-all/groovy=affecte |vy=new,fedora-all/groovy=af
|d,fedora-all/groovy18=affec |fected,fedora-all/groovy18=
|ted |affected
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1413466] CVE-2016-6814 Apache Groovy: Remote code execution via deserialization
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1413466
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|70114,reported=20170112,sou |70114,reported=20170112,sou
|rce=internet,cvss3=9.6/CVSS |rce=internet,cvss3=9.6/CVSS
|:3.0/AV:N/AC:L/PR:N/UI:R/S: |:3.0/AV:N/AC:L/PR:N/UI:R/S:
|C/C:H/I:H/A:H,amq-6/groovy= |C/C:H/I:H/A:H,amq-6/groovy=
|affected,jdv-6/groovy=affec |affected,jdv-6/groovy=affec
|ted/cvss3=8.3/CVSS:3.0/AV:N |ted/impact=moderate/cvss3=8
|/AC:H/PR:N/UI:R/S:C/C:H/I:H |.3/CVSS:3.0/AV:N/AC:H/PR:N/
|/A:H/impact=moderate,eap-5/ |UI:R/S:C/C:H/I:H/A:H,eap-5/
|groovy=wontfix,brms-5/groov |groovy=wontfix,brms-5/groov
|y=wontfix,soap-5/groovy=won |y=wontfix,soap-5/groovy=won
|tfix,eds-5/groovy=wontfix,f |tfix,eds-5/groovy=wontfix,f
|sw-6/camel=affected,fuse-6/ |sw-6/camel=affected,fuse-6/
|camel=affected,jon-3/groovy |camel=affected,jon-3/groovy
|=notaffected,epp-5/groovy=n |=notaffected,epp-5/groovy=n
|ew,openshift-enterprise-2/j |ew,openshift-enterprise-2/j
|enkins=new,rhev-m-3/jasperr |enkins=wontfix,rhev-m-3/jas
|eports-server-pro=new,rhel- |perreports-server-pro=wontf
|7/groovy=affected,rhn_satel |ix,rhel-7/groovy=affected,r
|lite_6/groovy=new,rhscl-2/r |hn_satellite_6/groovy=new,r
|h-maven33-groovy=new,fedora |hscl-2/rh-maven33-groovy=ne
|-all/groovy=affected,fedora |w,fedora-all/groovy=affecte
|-all/groovy18=affected |d,fedora-all/groovy18=affec
| |ted
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
Broken dependencies: aether-ant-tasks
by buildsys@fedoraproject.org
aether-ant-tasks has broken dependencies in the rawhide tree:
On x86_64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On armhfp:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64le:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On aarch64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On i386:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
Please resolve this as soon as possible.
6 years, 9 months
[Bug 1469005] New: maven-surefire: FTBFS in Fedora rawhide
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1469005
Bug ID: 1469005
Summary: maven-surefire: FTBFS in Fedora rawhide
Product: Fedora
Version: rawhide
Component: maven-surefire
Assignee: mizdebsk(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
Description of problem:
Package maven-surefire fails to build from source in Fedora rawhide.
Version-Release number of selected component (if applicable):
2.19.1-6.fc26
Steps to Reproduce:
koji build --scratch f27 maven-surefire-2.19.1-6.fc26.src.rpm
Additional info:
This package is tracked by Koschei. See:
http://apps.fedoraproject.org/koschei/package/maven-surefire
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1453012] New: F25 needs nasm-2.13 too
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1453012
Bug ID: 1453012
Summary: F25 needs nasm-2.13 too
Product: Fedora
Version: 25
Component: nasm
Assignee: mizdebsk(a)redhat.com
Reporter: h.reindl(a)thelounge.net
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
when you try to build the latest x264-snapshot on F25 you end in the follwojng
error and koji only shows a update some weeks ago to 2.13 for F27 which is way
too long - that X264 snapshot becomes AVX512 optimizations which become
relevant long before F27 can be considered for production here while the
hardware will be Skylake based Xeon
Found no assembler
Minimum version is nasm-2.13
If you really want to compile without asm, configure with --disable-asm.
Fehler: Fehler-Status beim Beenden von /var/tmp/rpm-tmp.IYgMkD (%build)
#define X264_VERSION " r2829 d1fe6fd"
#define X264_POINTVER "0.150.2829 d1fe6fd"
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1467347] New: /usr/bin/python3 /usr/share/java-utils/ pom_editor.py pom_remove_parent causes traceback in F24
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1467347
Bug ID: 1467347
Summary: /usr/bin/python3 /usr/share/java-utils/pom_editor.py
pom_remove_parent causes traceback in F24
Product: Fedora
Version: 24
Component: javapackages-tools
Assignee: mizdebsk(a)redhat.com
Reporter: mattias.ellert(a)physics.uu.se
QA Contact: extras-qa(a)fedoraproject.org
CC: ctubbsii(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mat.booth(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, msrb(a)redhat.com
Description of problem:
/usr/bin/python3 /usr/share/java-utils/pom_editor.py pom_remove_parent
Traceback (most recent call last):
File "/usr/share/java-utils/pom_editor.py", line 640, in <module>
macros[sys.argv[1]](*sys.argv[2:])
File "/usr/share/java-utils/pom_editor.py", line 466, in decorated
xml.patch(function, fnargs)
File "/usr/share/java-utils/pom_editor.py", line 258, in patch
function(**fnargs)
File "/usr/share/java-utils/pom_editor.py", line 583, in pom_remove_parent
etree.Comment(" parent POM reference removed by maintainer --> "))
File "src/lxml/lxml.etree.pyx", line 3017, in lxml.etree.Comment
(src/lxml/lxml.etree.c:77005)
ValueError: Comment may not contain '--' or end with '-'
Version-Release number of selected component (if applicable):
javapackages-tools.noarch 4.6.0-15.fc24
How reproducible:
Happens both in koji and in a local mock build
Steps to Reproduce:
1. Build jglobus-2.1.0-6.fc24.src.rpm
Actual results:
Traceback (see above)
Expected results:
Successful build
Additional info:
Only happens in F24.
EPEL7, F25, F26 and rawhide all work.
Failed build (F24):
https://koji.fedoraproject.org/koji/taskinfo?taskID=20305430
Same srpm build successfully on EPEL7, F25, F26 and rawhide:
https://koji.fedoraproject.org/koji/taskinfo?taskID=20305433
https://koji.fedoraproject.org/koji/taskinfo?taskID=20305428
https://koji.fedoraproject.org/koji/taskinfo?taskID=20305426
https://koji.fedoraproject.org/koji/taskinfo?taskID=20305425
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1464159] New: CVE-2017-9735 jetty: Timing channel attack in util/ security/Password.java [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1464159
Bug ID: 1464159
Summary: CVE-2017-9735 jetty: Timing channel attack in
util/security/Password.java [fedora-all]
Product: Fedora
Version: 25
Component: jetty
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: mizdebsk(a)redhat.com
Reporter: anemec(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
Broken dependencies: aether-ant-tasks
by buildsys@fedoraproject.org
aether-ant-tasks has broken dependencies in the rawhide tree:
On x86_64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On armhfp:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64le:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On aarch64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On i386:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
Please resolve this as soon as possible.
6 years, 9 months
Broken dependencies: aether-ant-tasks
by buildsys@fedoraproject.org
aether-ant-tasks has broken dependencies in the rawhide tree:
On x86_64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On armhfp:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64le:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On aarch64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On ppc64:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
On i386:
1:aether-ant-tasks-1.0.1-6.fc26.noarch requires xmvn-launcher
Please resolve this as soon as possible.
6 years, 9 months