https://bugzilla.redhat.com/show_bug.cgi?id=1599015
Bug ID: 1599015
Summary: antlr4: python 3 runtime support
Product: Fedora
Version: rawhide
Component: antlr4
Severity: medium
Assignee: mizdebsk(a)redhat.com
Reporter: loganjerry(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jkastner(a)redhat.com, lef(a)fedoraproject.org,
mizdebsk(a)redhat.com, msimacek(a)redhat.com,
projects.rg(a)smart.ms, puntogil(a)libero.it
Description of problem:
A new version of coq has been released. It requires the antlr4 4.7.1 python 3
runtime support package. When you update to version 4.7.1, would you please
also make a subpackage for the python 3 runtime? Thank you.
Version-Release number of selected component (if applicable):
N/A
How reproducible:
N/A
Steps to Reproduce:
1.
2.
3.
Actual results:
N/A
Expected results:
N/A
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1605391
Bug ID: 1605391
Summary: pdfbox: FTBFS in Fedora rawhide
Product: Fedora
Version: rawhide
Component: pdfbox
Assignee: puntogil(a)libero.it
Reporter: mboddu(a)bhujji.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
orion(a)nwra.com, puntogil(a)libero.it
Blocks: 1602938
pdfbox failed to build from source in Fedora rawhide
https://koji.fedoraproject.org/koji/taskinfo?taskID=28210529
For details on the mass rebuild see:
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
Please fix pdfbox at your earliest convenience and set the bug's status to
ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks,
pdfbox will be orphaned. Before branching of Fedora 30,
pdfbox will be retired, if it still fails to build.
For more details on the FTBFS policy, please visit:
https://fedoraproject.org/wiki/Fails_to_build_from_source
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1602938
[Bug 1602938] (F29FTBFS) Fedora 29 Mass Rebuild FTBFS Tracker
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1652285
Bug ID: 1652285
Summary: pdfbox-examples uninstallable
Product: Fedora
Version: 29
Component: pdfbox
Assignee: puntogil(a)libero.it
Reporter: phil(a)fifi.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Description of problem:
pdfbox-examples cannot be installed.
Version-Release number of selected component (if applicable):
pdfbox-examples-2.0.9-2.fc29.noarch
How reproducible:
Always
Steps to Reproduce:
1. dnf install --best --allowerasing pdfbox-examples-2.0.9-2.fc29.noarch
Actual results:
Error:
Problem: cannot install the best candidate for the job
- nothing provides mvn(org.apache.lucene:lucene-analyzers-common:4) needed by
pdfbox-examples-2.0.9-2.fc29.noarch
- nothing provides mvn(org.apache.lucene:lucene-core:4) needed by
pdfbox-examples-2.0.9-2.fc29.noarch
Expected results:
Package should install.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1607591
Bug ID: 1607591
Summary: CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can
lead to DoS
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abhgupta(a)redhat.com, aileenc(a)redhat.com,
alazarot(a)redhat.com, alee(a)redhat.com,
anstephe(a)redhat.com, apintea(a)redhat.com,
avibelli(a)redhat.com, bgeorges(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmoulliard(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dbaker(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, fgavrilo(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hghasemb(a)redhat.com, hhorak(a)redhat.com,
ibek(a)redhat.com, ikanello(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jcoleman(a)redhat.com,
jdoyle(a)redhat.com, jokerman(a)redhat.com,
jolee(a)redhat.com, jondruse(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jschatte(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, loleary(a)redhat.com,
lpetrovi(a)redhat.com, lthon(a)redhat.com,
mbabacek(a)redhat.com, mizdebsk(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, pgier(a)redhat.com,
pjurak(a)redhat.com, ppalaga(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
pszubiak(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sdaley(a)redhat.com,
spinder(a)redhat.com, sstavrev(a)redhat.com,
sthangav(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
trankin(a)redhat.com, trogers(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com
Flaw affecting tomcat 8.0.0.RC1 to 8.0.51 and 9.0.0.M1 to 9.0.7. An improper
handing of overflow in the UTF-8 decoder with supplementary characters can lead
to an infinite loop in the decoder causing a Denial of Service.
Upstream patch:
http://svn.apache.org/viewvc?view=rev&rev=1830375http://svn.apache.org/viewvc?view=rev&rev=1830373
References:
https://tomcat.apache.org/security-8.htmlhttps://tomcat.apache.org/security-9.html
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1578578
Bug ID: 1578578
Summary: CVE-2018-1257 spring-framework: ReDoS Attack with
spring-messaging
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, apevec(a)redhat.com,
bkundal(a)redhat.com, bmaxwell(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
chrisw(a)redhat.com, csutherl(a)redhat.com,
darran.lofthouse(a)redhat.com, dchen(a)redhat.com,
dffrench(a)redhat.com, dimitris(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
drusso(a)redhat.com, etirelli(a)redhat.com,
gvarsami(a)redhat.com, hghasemb(a)redhat.com,
ibek(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jcoleman(a)redhat.com,
jjoyce(a)redhat.com, jmadigan(a)redhat.com,
jolee(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, kbasil(a)redhat.com,
kconner(a)redhat.com, kverlaen(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, lgriffin(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lpetrovi(a)redhat.com,
markmc(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, myarboro(a)redhat.com,
ngough(a)redhat.com, nwallace(a)redhat.com,
nyechiel(a)redhat.com, paradhya(a)redhat.com,
pavelp(a)redhat.com, pgier(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
pszubiak(a)redhat.com, puntogil(a)libero.it,
pwright(a)redhat.com, rbryant(a)redhat.com,
rhel8-maint(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
rzhang(a)redhat.com, sclewis(a)redhat.com,
sdaley(a)redhat.com, sisharma(a)redhat.com,
slinaber(a)redhat.com, smohan(a)redhat.com,
ssaha(a)redhat.com, tcunning(a)redhat.com,
tdecacqu(a)redhat.com, tjay(a)redhat.com,
tkirby(a)redhat.com, trepel(a)redhat.com,
twalsh(a)redhat.com, vbellur(a)redhat.com,
vhalbert(a)redhat.com, vtunka(a)redhat.com
A flaw was found in Spring Framework, versions 5.0.x prior to 5.0.6, versions
4.3.x prior to 4.3.17, and older unsupported versions allows applications to
expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker
through the spring-messaging module. A malicious user (or attacker) can craft a
message to the broker that can lead to a regular expression, denial of service
attack.
References:
https://pivotal.io/security/cve-2018-1257
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1578902
Bug ID: 1578902
Summary: CVE-2018-1259 spring-framework: XXE with Spring Data’s
XMLBeam integration
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: lpardo(a)redhat.com
CC: dchen(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it
Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7,
used in combination with XMLBeam 1.4.14 or earlier versions, contains a
property binder vulnerability caused by improper restriction of XML external
entity references as underlying library XMLBeam does not restrict external
reference expansion. An unauthenticated remote malicious user can supply
specially crafted request parameters against Spring Data's projection-based
request payload binding to access arbitrary files on the system.
References:
https://pivotal.io/security/cve-2018-1259
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1508123
Bug ID: 1508123
Summary: CVE-2016-5003 xmlrpc: Deserialization of untrusted
Java object through <ex:serializable> tag
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: abhgupta(a)redhat.com, bmcclain(a)redhat.com,
dbhole(a)redhat.com, dblechte(a)redhat.com,
dwalluck(a)redhat.com, eedri(a)redhat.com,
hhorak(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jorton(a)redhat.com, krzysztof.daniel(a)gmail.com,
kseifried(a)redhat.com, mgoldboi(a)redhat.com,
michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com,
msimacek(a)redhat.com, puntogil(a)libero.it,
sbonazzo(a)redhat.com, sherold(a)redhat.com,
sochotni(a)redhat.com, tiwillia(a)redhat.com,
ykaul(a)redhat.com, ylavi(a)redhat.com
The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva,
allows remote attackers to execute arbitrary code via a crafted serialized Java
object in an <ex:serializable> element.
References:
http://www.openwall.com/lists/oss-security/2016/07/12/5https://0ang3el.blogspot.in/2016/07/beware-of-ws-xmlrpc-library-in-your.html
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1372120
Bug ID: 1372120
Summary: CVE-2016-6346 RESTEasy: Abuse of GZIPInterceptor in
RESTEasy can lead to denial of service attack
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: jshepherd(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, aszczucz(a)redhat.com,
bazulay(a)redhat.com, bbaranow(a)redhat.com,
bdawidow(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmcclain(a)redhat.com,
cbillett(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, csutherl(a)redhat.com,
dandread(a)redhat.com, darran.lofthouse(a)redhat.com,
dblechte(a)redhat.com, dosoudil(a)redhat.com,
eedri(a)redhat.com, epp-bugs(a)redhat.com,
etirelli(a)redhat.com, felias(a)redhat.com,
fnasser(a)redhat.com, gklein(a)redhat.com,
gvarsami(a)redhat.com, hchiorea(a)redhat.com,
hfnukal(a)redhat.com, huwang(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jboss-set(a)redhat.com,
jbpapp-maint(a)redhat.com, jcoleman(a)redhat.com,
jdg-bugs(a)redhat.com, jmatthew(a)redhat.com,
jolee(a)redhat.com, jpallich(a)redhat.com,
jshepherd(a)redhat.com, katello-bugs(a)redhat.com,
kconner(a)redhat.com, kseifried(a)redhat.com,
kverlaen(a)redhat.com, ldimaggi(a)redhat.com,
lgao(a)redhat.com, lpetrovi(a)redhat.com,
lsurette(a)redhat.com, mbaluch(a)redhat.com,
mgoldboi(a)redhat.com, mgoldman(a)redhat.com,
miburman(a)redhat.com, michal.skrivanek(a)redhat.com,
mmccune(a)redhat.com, mweiler(a)redhat.com,
mwinkler(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, ohadlevy(a)redhat.com,
oourfali(a)redhat.com, pavelp(a)redhat.com,
pgier(a)redhat.com, pkliczew(a)redhat.com,
psakar(a)redhat.com, pslavice(a)redhat.com,
puntogil(a)libero.it, rcernich(a)redhat.com,
Rhev-m-bugs(a)redhat.com, rnetuka(a)redhat.com,
rrajasek(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, rzhang(a)redhat.com,
satellite6-bugs(a)redhat.com, sherold(a)redhat.com,
soa-p-jira(a)post-office.corp.redhat.com,
spinder(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, tomckay(a)redhat.com,
tsanders(a)redhat.com, ttarrant(a)redhat.com,
twalsh(a)redhat.com, vhalbert(a)redhat.com,
vtunka(a)redhat.com, weli(a)redhat.com, ydary(a)redhat.com,
ykaul(a)redhat.com
It was found that GZIPInterceptor is enabled when not necessarily required in
RESTEasy. An attacker could use this flaw to launch a Denial of Service attack.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1448498
Bug ID: 1448498
Summary: apache-sshd-1.4.0 is available
Product: Fedora
Version: rawhide
Component: apache-sshd
Keywords: Rebase
Assignee: msrb(a)redhat.com
Reporter: sbonazzo(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
msrb(a)redhat.com, puntogil(a)libero.it
Latest upstream release: 1.4.0
Current version/release in rawhide: 0.14.0-5.fc26
URL: www.eu.apache.org/dist/mina/sshd
Based on the information from anitya:
https://release-monitoring.org/project/15120/
Opened manually since integration with anitya and upstream release monitoring
is turned off in
https://admin.fedoraproject.org/pkgdb/package/rpms/apache-sshd/
--
You are receiving this mail because:
You are on the CC list for the bug.