[Bug 1476055] New: takari-incrementalbuild-0.20.5 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1476055
Bug ID: 1476055
Summary: takari-incrementalbuild-0.20.5 is available
Product: Fedora
Version: rawhide
Component: takari-incrementalbuild
Keywords: FutureFeature, Triaged
Assignee: mizdebsk(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com
Latest upstream release: 0.20.5
Current version/release in rawhide: 0.20.4-2.fc26
URL: http://takari.io
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/9579/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1481005] rpmbuild traceback by building
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1481005
Miro Hrončok <mhroncok(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |ctubbsii(a)fedoraproject.org,
| |java-sig-commits(a)lists.fedo
| |raproject.org,
| |mat.booth(a)redhat.com,
| |mizdebsk(a)redhat.com,
| |msimacek(a)redhat.com,
| |msrb(a)redhat.com
Component|python |javapackages-tools
Assignee|cstratak(a)redhat.com |mizdebsk(a)redhat.com
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1473260] New: CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper [ fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1473260
Bug ID: 1473260
Summary: CVE-2017-7525 jackson-databind: Deserialization
vulnerability via readValue method of ObjectMapper
[fedora-all]
Product: Fedora
Version: 26
Component: jackson-databind
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: puntogil(a)libero.it
Reporter: rasanche(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1413466] CVE-2016-6814 Apache Groovy: Remote code execution via deserialization
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1413466
Kurt Seifried <kseifried(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|70114,reported=20170112,sou |70114,reported=20170112,sou
|rce=internet,cvss3=9.6/CVSS |rce=internet,cvss3=9.6/CVSS
|:3.0/AV:N/AC:L/PR:N/UI:R/S: |:3.0/AV:N/AC:L/PR:N/UI:R/S:
|C/C:H/I:H/A:H,amq-6/groovy= |C/C:H/I:H/A:H,amq-6/groovy=
|affected,jdv-6/groovy=affec |affected,jdv-6/groovy=affec
|ted/impact=moderate/cvss3=8 |ted/impact=moderate/cvss3=8
|.3/CVSS:3.0/AV:N/AC:H/PR:N/ |.3/CVSS:3.0/AV:N/AC:H/PR:N/
|UI:R/S:C/C:H/I:H/A:H,eap-5/ |UI:R/S:C/C:H/I:H/A:H,eap-5/
|groovy=wontfix,brms-5/groov |groovy=wontfix,brms-5/groov
|y=wontfix,soap-5/groovy=won |y=wontfix,soap-5/groovy=won
|tfix,eds-5/groovy=wontfix,f |tfix,eds-5/groovy=wontfix,f
|sw-6/camel=affected,fuse-6/ |sw-6/camel=affected,fuse-6/
|camel=affected,jon-3/groovy |camel=affected,jon-3/groovy
|=notaffected,epp-5/groovy=n |=notaffected,epp-5/groovy=n
|ew,openshift-enterprise-2/j |ew,openshift-enterprise-2/j
|enkins=wontfix,rhev-m-3/jas |enkins=wontfix,rhev-m-3/jas
|perreports-server-pro=wontf |perreports-server-pro=wontf
|ix,rhel-7/groovy=affected,r |ix,rhel-7/groovy=affected,r
|hn_satellite_6/groovy=affec |hn_satellite_6/groovy=notaf
|ted,rhscl-2/rh-maven33-groo |fected,rhscl-2/rh-maven33-g
|vy=affected,fedora-all/groo |roovy=affected,fedora-all/g
|vy=affected,fedora-all/groo |roovy=affected,fedora-all/g
|vy18=affected |roovy18=affected
--- Comment #16 from Kurt Seifried <kseifried(a)redhat.com> ---
Satellite 6 doesn't actually use groovy so marking notaffected and closing.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1409838] New: CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1409838
Bug ID: 1409838
Summary: CVE-2016-9879 Spring Security: Improper handling of
path parameters allows bypassing the security
constraint
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
bmcclain(a)redhat.com, chazlett(a)redhat.com,
dblechte(a)redhat.com, dmcphers(a)redhat.com,
eedri(a)redhat.com, gklein(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, jokerman(a)redhat.com,
kseifried(a)redhat.com, lmeyer(a)redhat.com,
lsurette(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mmccomas(a)redhat.com,
puntogil(a)libero.it, rbalakri(a)redhat.com,
Rhev-m-bugs(a)redhat.com, sbonazzo(a)redhat.com,
sherold(a)redhat.com, srevivo(a)redhat.com,
tiwillia(a)redhat.com, ydary(a)redhat.com,
ykaul(a)redhat.com
Spring Security does not consider URL path parameters when processing security
constraints. By adding a URL path parameter with an encoded "/" to a request,
an attacker may be able to bypass a security constraint. The root cause of this
issue is a lack of clarity regarding the handling of path parameters in the
Servlet Specification (see below). Some Servlet containers include path
parameters in the value returned for getPathInfo() and some do not. Spring
Security uses the value returned by getPathInfo() as part of the process of
mapping requests to security constraints. The unexpected presence of path
parameters can cause a constraint to be bypassed.
Users of Apache Tomcat (all current versions) are not affected by this
vulnerability since Tomcat follows the guidance previously provided by the
Servlet Expert group and strips path parameters from the value returned by
getContextPath(), getServletPath() and getPathInfo().
Users of other Servlet containers based on Apache Tomcat may or may not be
affected depending on whether or not the handling of path parameters has been
modified.
Users of IBM WebSphere Application Server 8.5.x are known to be affected.
Users of other containers that implement the Servlet specification may be
affected.
Mitigation:
Use a Servlet container known not to include path parameters in the return
values for getServletPath() and getPathInfo()
Upstream bug:
https://github.com/spring-projects/spring-security/issues/4169
External Reference:
https://pivotal.io/security/cve-2016-9879
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1380898] New: Spurious EOF error when reading build.sbt
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1380898
Bug ID: 1380898
Summary: Spurious EOF error when reading build.sbt
Product: Fedora
Version: 24
Component: sbt
Severity: medium
Assignee: willb(a)redhat.com
Reporter: greenrd(a)greenrd.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, s(a)shk.io, willb(a)redhat.com
Description of problem:
I get this error:
build.sbt:272: error: ';' expected but eof found.
val projectInfoFile = dir / "ProjectInfo.scala"
^
sbt.compiler.EvalException: Error parsing definition. Ensure that there are no
blank lines within a definition.
But the file build.sbt does not end on line 272!
Version-Release number of selected component (if applicable):
sbt-0.13.1-8.fc24.1.noarch
How reproducible:
Always
Steps to Reproduce:
Unfortunately this requires our proprietary source code, but maybe it can be
reproduced by cloning another Scala repo and running sbt compile.
Actual results:
See above
Expected results:
Should build as it does on another machines (e.g. a Fedora 24 machine with the
Lightbend sbt RPM installed).
Additional info:
project/build.properties contains:
sbt.version=0.13.12
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months