[Bug 1353905] CVE-2016-5007 springframework-security: spring: Path matching inconsistency [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1353905
Jan Kurik <jkurik(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Version|24 |25
--- Comment #4 from Jan Kurik <jkurik(a)redhat.com> ---
Fedora 24 changed to end-of-life (EOL) status on 2017-08-08. Fedora 24 is
no longer maintained, which means that it will not receive any further
security or bug fix updates.
As this is a security big we are moving this bug to the currently latest
supported release. Please check whether this bug is still applicable.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1353904] CVE-2016-5007 springframework: spring: Path matching inconsistency [fedora-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1353904
Jan Kurik <jkurik(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Version|24 |25
--- Comment #4 from Jan Kurik <jkurik(a)redhat.com> ---
Fedora 24 changed to end-of-life (EOL) status on 2017-08-08. Fedora 24 is
no longer maintained, which means that it will not receive any further
security or bug fix updates.
As this is a security big we are moving this bug to the currently latest
supported release. Please check whether this bug is still applicable.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1469022] New: jna: duplicate manifest
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1469022
Bug ID: 1469022
Summary: jna: duplicate manifest
Product: Fedora
Version: rawhide
Component: jna
Assignee: mizdebsk(a)redhat.com
Reporter: mizdebsk(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
lfarkas(a)lfarkas.org, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, walters(a)redhat.com
Blocks: 1467724
JNA JAR has duplicate manifest (two different manifest files):
$ jar tf /chroot/usr/lib/java/jna.jar |grep -i mani
META-INF/MANIFEST.MF
META-INF/MANIFEST.MF
JAR file format requires manifest to be the very first entry.
Upstream build.xml creates JAR using Ant <zip> task, which is not aware of JAR
file format and breaks it by adding META-INF/ directory entry before manifest
file.
This causes %mvn_install to add second copy of the manifest.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1467724
[Bug 1467724] Gradle builds stopped working since jna-4.4.0-2.fc27
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months
[Bug 1477540] New: CVE-2017-9801 apache-commons-email: SMTP header injection vulnerabilty
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1477540
Bug ID: 1477540
Summary: CVE-2017-9801 apache-commons-email: SMTP header
injection vulnerabilty
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: java-sig-commits(a)lists.fedoraproject.org,
SpikeFedora(a)gmail.com
When a call-site passes a subject for an email that contains line-breaks, the
caller can add arbitrary SMTP headers.
This vulnerability can be mitigated for older versions of Commons Email by
stripping line-breaks from the subject before passing it to the
setSubject(String) method.
References:
http://seclists.org/oss-sec/2017/q3/231
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 8 months