[Bug 1495250] New: [xalan-j2] zip -u in spec file causes race condition
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1495250
Bug ID: 1495250
Summary: [xalan-j2] zip -u in spec file causes race condition
Product: Fedora
Version: rawhide
Component: xalan-j2
Assignee: mizdebsk(a)redhat.com
Reporter: tdawson(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com
Description of problem:
zip -u is being used to update META-INF/MANIFEST.MF in jar files
zip -u will "Update existing entries if newer on the file system"
Unfortunately zip is only looking at the minute that a file is updated. We are
finding on fast test machines that the content of the jar, and the new
META-INF/MANIFEST.MF, are being created in the same minute. Thus when the zip
-u is ran, the MANIFEST.MF isn't updated, zip returns a non 0 error code, and
the build fails.
"zip -u" should be changed to "zip", which changes the zip command from
"update" to "add"
zip (add) will "Update existing entries and add new files. ... This is the
default mode."
If you can change your spec files to use just "zip" instead of "zip -u", that
will solve this race condition
Version-Release number of selected component (if applicable):
xalan-j2-2.7.1-32.fc27
How reproducible:
5-95% - depending on the speed of the machine.
Steps to Reproduce:
1. koji build
2.
3.
Actual results:
+ zip -u build/lib/<jar-name>.jar META-INF/MANIFEST.MF
RPM build errors:
error: Bad exit status from /var/tmp/rpm-tmp.oh6WeU (%build)
Bad exit status from /var/tmp/rpm-tmp.oh6WeU (%build)
Child return code was: 1
Expected results:
...
+ zip -u build/lib/<jar-name>.jar META-INF/MANIFEST.MF
updating: META-INF/MANIFEST.MF (deflated 56%)
...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1413466] CVE-2016-6814 Apache Groovy: Remote code execution via deserialization
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1413466
Doran Moppert <dmoppert(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|70114,reported=20170112,sou |70114,reported=20170112,sou
|rce=internet,cvss3=9.6/CVSS |rce=internet,cvss3=9.6/CVSS
|:3.0/AV:N/AC:L/PR:N/UI:R/S: |:3.0/AV:N/AC:L/PR:N/UI:R/S:
|C/C:H/I:H/A:H,cwe=CWE-502,a |C/C:H/I:H/A:H,cwe=CWE-502,a
|mq-6/groovy=affected,jdv-6/ |mq-6/groovy=affected,jdv-6/
|groovy=affected/impact=mode |groovy=affected/cvss3=8.3/C
|rate/cvss3=8.3/CVSS:3.0/AV: |VSS:3.0/AV:N/AC:H/PR:N/UI:R
|N/AC:H/PR:N/UI:R/S:C/C:H/I: |/S:C/C:H/I:H/A:H/impact=mod
|H/A:H,eap-5/groovy=wontfix, |erate,eap-5/groovy=wontfix,
|brms-5/groovy=wontfix,soap- |brms-5/groovy=wontfix,soap-
|5/groovy=wontfix,eds-5/groo |5/groovy=wontfix,eds-5/groo
|vy=wontfix,fsw-6/camel=affe |vy=wontfix,fsw-6/camel=affe
|cted,fuse-6/camel=affected, |cted,fuse-6/camel=affected,
|jon-3/groovy=notaffected,ep |jon-3/groovy=notaffected,ep
|p-5/groovy=new,openshift-en |p-5/groovy=new,openshift-en
|terprise-2/jenkins=wontfix, |terprise-2/jenkins=wontfix,
|rhev-m-3/jasperreports-serv |rhev-m-3/jasperreports-serv
|er-pro=wontfix,rhel-7/groov |er-pro=wontfix,rhel-7/groov
|y=affected,rhn_satellite_6/ |y=affected,rhn_satellite_6/
|groovy=notaffected,rhscl-2/ |groovy=notaffected,rhscl-2/
|rh-maven33-groovy=affected, |rh-maven33-groovy=affected,
|fedora-all/groovy=affected, |fedora-all/groovy=affected,
|fedora-all/groovy18=affecte |fedora-all/groovy18=affecte
|d |d
--- Comment #24 from Doran Moppert <dmoppert(a)redhat.com> ---
Analysis in comment 22 confirmed: the patch for this issue alone also resolves
CVE-2015:3253.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1493222] CVE-2017-12616 tomcat: Information Disclosure when using VirtualDirContext
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1493222
Doran Moppert <dmoppert(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0919,reported=20170919,sour |0919,reported=20170919,sour
|ce=internet,cvss3=5.3/CVSS: |ce=internet,cvss3=5.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:L/I:N/A:N,cwe=CWE-200,rh |/C:L/I:N/A:N,cwe=CWE-200,rh
|el-7/tomcat=new,rhscl-2/rh- |el-7/tomcat=wontfix,rhscl-2
|java-common-tomcat=notaffec |/rh-java-common-tomcat=nota
|ted,jbews-2/tomcat7=wontfix |ffected,jbews-2/tomcat7=won
|,jws-3/tomcat7=affected,jws |tfix,jws-3/tomcat7=affected
|-3/tomcat8=notaffected,jdg- |,jws-3/tomcat8=notaffected,
|6/jbossweb=notaffected,jdv- |jdg-6/jbossweb=notaffected,
|6/jbossweb=notaffected,eap- |jdv-6/jbossweb=notaffected,
|6/jbossweb=wontfix,fuse-6/j |eap-6/jbossweb=wontfix,fuse
|bossweb=new,jon-3/jbossweb= |-6/jbossweb=new,jon-3/jboss
|wontfix,jpp-6/jbossweb=wont |web=wontfix,jpp-6/jbossweb=
|fix,openshift-1/jbossweb=af |wontfix,openshift-1/jbosswe
|fected,fedora-all/tomcat=no |b=affected,fedora-all/tomca
|taffected,epel-6/tomcat=aff |t=notaffected,epel-6/tomcat
|ected,rhel-6/tomcat6=new |=affected,rhel-6/tomcat6=wo
| |ntfix
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1493222] CVE-2017-12616 tomcat: Information Disclosure when using VirtualDirContext
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1493222
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0919,reported=20170919,sour |0919,reported=20170919,sour
|ce=internet,cvss3=5.3/CVSS: |ce=internet,cvss3=5.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:L/I:N/A:N,cwe=CWE-200,rh |/C:L/I:N/A:N,cwe=CWE-200,rh
|el-7/tomcat=new,rhscl-2/rh- |el-7/tomcat=new,rhscl-2/rh-
|java-common-tomcat=notaffec |java-common-tomcat=notaffec
|ted,jbews-2/tomcat7=wontfix |ted,jbews-2/tomcat7=wontfix
|,jws-3/tomcat7=wontfix,jws- |,jws-3/tomcat7=affected,jws
|3/tomcat8=notaffected,jdg-6 |-3/tomcat8=notaffected,jdg-
|/jbossweb=notaffected,jdv-6 |6/jbossweb=notaffected,jdv-
|/jbossweb=notaffected,eap-6 |6/jbossweb=notaffected,eap-
|/jbossweb=wontfix,fuse-6/jb |6/jbossweb=wontfix,fuse-6/j
|ossweb=new,jon-3/jbossweb=w |bossweb=new,jon-3/jbossweb=
|ontfix,jpp-6/jbossweb=wontf |wontfix,jpp-6/jbossweb=wont
|ix,openshift-1/jbossweb=aff |fix,openshift-1/jbossweb=af
|ected,fedora-all/tomcat=not |fected,fedora-all/tomcat=no
|affected,epel-6/tomcat=affe |taffected,epel-6/tomcat=aff
|cted,rhel-6/tomcat6=new |ected,rhel-6/tomcat6=new
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1493222] CVE-2017-12616 tomcat: Information Disclosure when using VirtualDirContext
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1493222
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0919,reported=20170919,sour |0919,reported=20170919,sour
|ce=internet,cvss3=5.3/CVSS: |ce=internet,cvss3=5.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:L/I:N/A:N,cwe=CWE-200,rh |/C:L/I:N/A:N,cwe=CWE-200,rh
|el-7/tomcat=new,rhscl-2/rh- |el-7/tomcat=new,rhscl-2/rh-
|java-common-tomcat=notaffec |java-common-tomcat=notaffec
|ted,jbews-2/tomcat7=wontfix |ted,jbews-2/tomcat7=wontfix
|,jws-3/tomcat7=wontfix,jws- |,jws-3/tomcat7=wontfix,jws-
|3/tomcat8=notaffected,jdg-6 |3/tomcat8=notaffected,jdg-6
|/jbossweb=notaffected,jdv-6 |/jbossweb=notaffected,jdv-6
|/jbossweb=notaffected,eap-6 |/jbossweb=notaffected,eap-6
|/jbossweb=wontfix,fuse-6/jb |/jbossweb=wontfix,fuse-6/jb
|ossweb=new,jon-3/jbossweb=n |ossweb=new,jon-3/jbossweb=w
|ew,jpp-6/jbossweb=wontfix,o |ontfix,jpp-6/jbossweb=wontf
|penshift-1/jbossweb=affecte |ix,openshift-1/jbossweb=aff
|d,fedora-all/tomcat=notaffe |ected,fedora-all/tomcat=not
|cted,epel-6/tomcat=affected |affected,epel-6/tomcat=affe
|,rhel-6/tomcat6=new |cted,rhel-6/tomcat6=new
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months
[Bug 1493222] CVE-2017-12616 tomcat: Information Disclosure when using VirtualDirContext
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1493222
Jason Shepherd <jshepherd(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2017 |impact=moderate,public=2017
|0919,reported=20170919,sour |0919,reported=20170919,sour
|ce=internet,cvss3=5.3/CVSS: |ce=internet,cvss3=5.3/CVSS:
|3.0/AV:N/AC:L/PR:N/UI:N/S:U |3.0/AV:N/AC:L/PR:N/UI:N/S:U
|/C:L/I:N/A:N,cwe=CWE-200,rh |/C:L/I:N/A:N,cwe=CWE-200,rh
|el-7/tomcat=new,rhscl-2/rh- |el-7/tomcat=new,rhscl-2/rh-
|java-common-tomcat=notaffec |java-common-tomcat=notaffec
|ted,jbews-2/tomcat7=wontfix |ted,jbews-2/tomcat7=wontfix
|,jws-3/tomcat7=wontfix,jws- |,jws-3/tomcat7=wontfix,jws-
|3/tomcat8=notaffected,jdg-6 |3/tomcat8=notaffected,jdg-6
|/jbossweb=notaffected,jdv-6 |/jbossweb=notaffected,jdv-6
|/jbossweb=notaffected,eap-6 |/jbossweb=notaffected,eap-6
|/jbossweb=new,fuse-6/jbossw |/jbossweb=wontfix,fuse-6/jb
|eb=new,jon-3/jbossweb=new,j |ossweb=new,jon-3/jbossweb=n
|pp-6/jbossweb=wontfix,opens |ew,jpp-6/jbossweb=wontfix,o
|hift-1/jbossweb=affected,fe |penshift-1/jbossweb=affecte
|dora-all/tomcat=notaffected |d,fedora-all/tomcat=notaffe
|,epel-6/tomcat=affected,rhe |cted,epel-6/tomcat=affected
|l-6/tomcat6=new |,rhel-6/tomcat6=new
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 9 months