[Bug 1700305] New: package hamcrest-1.3-25.fc30.noarch requires hamcrest-core = 1.3-25.fc30, but none of the providers can be installed - hamcrest-1.3-24.fc29.noarch does not belong to a distupgrade repository
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1700305
Bug ID: 1700305
Summary: package hamcrest-1.3-25.fc30.noarch requires
hamcrest-core = 1.3-25.fc30, but none of the providers
can be installed - hamcrest-1.3-24.fc29.noarch does
not belong to a distupgrade repository
Product: Fedora
Version: 29
Status: NEW
Component: hamcrest
Assignee: dwalluck(a)redhat.com
Reporter: sanjay.ankur(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, dwalluck(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
Experiencing this while trying to dnf system-upgrade to F30:
sudo dnf system-upgrade download --refresh --releasever=30
--setopt='module_platform_id=platform:f30' stops at:
Problem 3: problem with installed package hamcrest-1.3-24.fc29.noarch
- package hamcrest-1.3-25.fc30.noarch requires hamcrest-core = 1.3-25.fc30,
but none of the providers can be installed
- hamcrest-1.3-24.fc29.noarch does not belong to a distupgrade repository
- package hamcrest-core-1.3-25.fc30.noarch is excluded
Current workaround is to remove the package and then re-run the command.
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 5 months
[Bug 1674100] New: log4j-2.11.2 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1674100
Bug ID: 1674100
Summary: log4j-2.11.2 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: log4j
Keywords: FutureFeature, Triaged
Assignee: extras-orphan(a)fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, devrim(a)gunduz.org,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, sochotni(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 2.11.2
Current version/release in rawhide: 2.11.1-3.fc30
URL: http://www.apache.org/dist/logging/log4j
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1836/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 5 months
[Bug 1699740] New: CVE-2019-0228 pdfbox: XML External Entity (XXE) attacks via a crafted XFDF
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1699740
Bug ID: 1699740
Summary: CVE-2019-0228 pdfbox: XML External Entity (XXE)
attacks via a crafted XFDF
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190412,reported=20190412,sour
ce=oss-security,cvss3=5.9/CVSS:3.0/AV:L/AC:L/PR:N/UI:N
/S:U/C:L/I:L/A:L,cwe=CWE-611,fedora-all/pdfbox=affecte
d,fsw-6/pdfbox=affected,fuse-6/pdfox=affected,fuse-7/p
dfbox=affected
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: aileenc(a)redhat.com, chazlett(a)redhat.com,
gvarsami(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
kconner(a)redhat.com, ldimaggi(a)redhat.com,
nwallace(a)redhat.com, puntogil(a)libero.it,
rwagner(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com
Target Milestone: ---
Classification: Other
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows
context-dependent attackers to conduct XML External Entity (XXE) attacks via a
crafted XFDF.
Reference:
https://www.openwall.com/lists/oss-security/2019/04/12/1
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 6 months
[Bug 1688950] New: tomcat-users.xml has open file descriptors and opens tomcat-users.xml all the time
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1688950
Bug ID: 1688950
Summary: tomcat-users.xml has open file descriptors and opens
tomcat-users.xml all the time
Product: Fedora
Version: 29
Hardware: x86_64
OS: Linux
Status: NEW
Component: tomcat
Severity: high
Assignee: ivan.afonichev(a)gmail.com
Reporter: p.zandbergen(a)macroscoop.nl
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
External Bug ID: Apache Bugzilla 62924
Classification: Fedora
Description of problem:
Tomcat 9.0.13 reopens tomcat-users.xml all the time, causing application to run
out of file descriptors
Version-Release number of selected component (if applicable):
1:9.0.13-1.fc29
How reproducible:
Hard, requires tomcat application unavailable in Fedora.
Steps to Reproduce:
1. start tomcat application
2. use it for a while
Actual results:
Tomcat application fails. Error message in /var/log/tomcat/catalina.log:
13-Mar-2019 14:33:21.939 SEVERE [http-nio-8080-Acceptor-0]
org.apache.tomcat.util.net.Acceptor.run Socket accept failed
java.io.IOException: Too many open files
Expected results:
Tomcat application runs indefinitely
Additional info:
Downgrading to 1:9.0.10-1.fc29 solves the issue
Issue is fixed upstream in 9.0.14
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 7 months
[Bug 1690651] New: Tomcat 9.0.13 update incompatible with tomcat-native
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1690651
Bug ID: 1690651
Summary: Tomcat 9.0.13 update incompatible with tomcat-native
Product: Fedora
Version: 29
OS: Linux
Status: NEW
Component: tomcat
Severity: high
Assignee: ivan.afonichev(a)gmail.com
Reporter: lumetili(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Fedora
Description of problem:
When Tomcat is updated to version 9.0.13 from the 9.0.10 release initially
included with Fedora, TLS (-> OpenSSL, Tomcat Native) stops working due to a
library version issue...
Version-Release number of selected component (if applicable):
tomcat 9.0.13
tomcat-native
How reproducible:
Always
Steps to Reproduce:
1. Update from Tomcat 9.0.10 (Fedora 29 base version) to Tomcat 9.0.13
2. Start Tomcat
3. Errors in logs and TLS doesn't work
Actual results:
Tomcat unreachable with TLS
Expected results:
TLS should work
Additional info:
Relevant log output after update:
systemd[1]: Started Apache Tomcat Web Application Container.
...
server[6394]: 19-Mar-2019 19:24:32.550 INFO [main]
org.apache.catalina.core.AprLifecycleListener.lifecycleEvent An older version
[1.2.17] of the APR based Apache Tomcat Native library is installed, while
Tomcat recommends a minimum version of [1.2.18]
server[6394]: 19-Mar-2019 19:24:32.553 INFO [main]
org.apache.catalina.core.AprLifecycleListener.lifecycleEvent Loaded APR based
Apache Tomcat Native library [1.2.17] using APR version [1.6.5].
server[6394]: 19-Mar-2019 19:24:32.553 INFO [main]
org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR capabilities:
IPv6 [true], sendfile [true], accept filters [false], random [true].
server[6394]: 19-Mar-2019 19:24:32.554 INFO [main]
org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR/OpenSSL
configuration: useAprConnector [false], useOpenSSL [true]
server[6394]: 19-Mar-2019 19:24:32.557 INFO [main]
org.apache.catalina.core.AprLifecycleListener.initializeSSL OpenSSL
successfully initialized [OpenSSL 1.1.1b FIPS 26 Feb 2019]
...
When handling requests:
server[1555]: 18-Mar-2019 03:03:17.915 INFO [main]
org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler
["https-openssl-nio-8443"]
server[1555]: 18-Mar-2019 03:03:17.918 INFO [main]
org.apache.catalina.startup.Catalina.start Server startup in 4162 ms
server[1555]: 18-Mar-2019 03:03:18.980 SEVERE [https-openssl-nio-8443-exec-4]
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun
server[1555]: java.lang.UnsatisfiedLinkError:
org.apache.tomcat.jni.SSL.renegotiatePending(J)I
server[1555]: at org.apache.tomcat.jni.SSL.renegotiatePending(Native
Method)
server[1555]: at
org.apache.tomcat.util.net.openssl.OpenSSLEngine.getHandshakeStatus(OpenSSLEngine.java:1021)
server[1555]: at
org.apache.tomcat.util.net.openssl.OpenSSLEngine.wrap(OpenSSLEngine.java:457)
server[1555]: at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:469)
server[1555]: at
org.apache.tomcat.util.net.SecureNioChannel.handshakeWrap(SecureNioChannel.java:440)
server[1555]: at
org.apache.tomcat.util.net.SecureNioChannel.handshake(SecureNioChannel.java:211)
server[1555]: at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1394)
server[1555]: at
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
server[1555]: at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
server[1555]: at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
server[1555]: at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
server[1555]: at java.lang.Thread.run(Thread.java:748)
Workaround: downgrade Tomcat to 9.0.10
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 7 months