[Bug 1884425] New: jackson-core-2.11.3 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1884425
Bug ID: 1884425
Summary: jackson-core-2.11.3 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: jackson-core
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it, roman(a)fenkhuber.at
Target Milestone: ---
Classification: Fedora
Latest upstream release: 2.11.3
Current version/release in rawhide: 2.11.2-1.fc33
URL: https://github.com/FasterXML/jackson-core
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/10962/
--
You are receiving this mail because:
You are on the CC list for the bug.
3 hours, 16 minutes
[Bug 1683547] New: lucene-7.7.1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1683547
Bug ID: 1683547
Summary: lucene-7.7.1 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: lucene
Keywords: FutureFeature, Triaged
Assignee: akurtako(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, dbhole(a)redhat.com,
dingyichen(a)gmail.com,
eclipse-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com,
lef(a)fedoraproject.org, rgrunber(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 7.7.1
Current version/release in rawhide: 7.7.0-1.fc30
URL: http://lucene.apache.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/7178/
--
You are receiving this mail because:
You are on the CC list for the bug.
3 hours, 37 minutes
[Bug 1745960] New: Request to build tomcat for EPEL 8
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1745960
Bug ID: 1745960
Summary: Request to build tomcat for EPEL 8
Product: Fedora EPEL
Version: el6
Status: NEW
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: adam.winberg(a)smhi.se
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Fedora
Tomcat is not available from official Red Hat repos in RHEL8, so no conflict
should exist?
--
You are receiving this mail because:
You are on the CC list for the bug.
4 days, 17 hours
[Bug 1870860] New: auto-1.7.4 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1870860
Bug ID: 1870860
Summary: auto-1.7.4 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: auto
Keywords: FutureFeature, Triaged
Assignee: mat.booth(a)redhat.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, mat.booth(a)redhat.com,
puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
Latest upstream release: 1.7.4
Current version/release in rawhide: 1.5.4-4.fc33
URL: https://github.com/google/auto
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/6371/
--
You are receiving this mail because:
You are on the CC list for the bug.
5 days, 17 hours
[Bug 1853928] New: tomcat-9.0.37 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1853928
Bug ID: 1853928
Summary: tomcat-9.0.37 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: tomcat
Keywords: FutureFeature, Triaged
Assignee: ivan.afonichev(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, huwang(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 9.0.37
Current version/release in rawhide: 9.0.35-2.fc33
URL: http://tomcat.apache.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/17032/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 days, 9 hours
[Bug 1806835] New: CVE-2020-1935 tomcat: HTTP Request Smuggling
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1806835
Bug ID: 1806835
Summary: CVE-2020-1935 tomcat: HTTP Request Smuggling
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: jwon(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bgeorges(a)redhat.com,
bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmoulliard(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
gzaronik(a)redhat.com, ibek(a)redhat.com,
ikanello(a)redhat.com, ivan.afonichev(a)gmail.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschluet(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kbasil(a)redhat.com, krathod(a)redhat.com,
krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com,
lpeer(a)redhat.com, lthon(a)redhat.com,
mbabacek(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
tom.jenkinson(a)redhat.com, weli(a)redhat.com
Target Milestone: ---
Classification: Other
The HTTP header parsing code used an approach to end-of-line (EOL) parsing that
allowed some invalid HTTP headers to be parsed as valid. This led to a
possibility of HTTP Request Smuggling if Tomcat was located behind a reverse
proxy that incorrectly handled the invalid Transfer-Encoding header in a
particular manner. Such a reverse proxy is considered unlikely.
It affects the version of Apache Tomcat 9 before 9.0.31, Tomcat 8 before
8.5.51, and Tomcat 7 before 7.0.100.
Upstream Patches:
https://github.com/apache/tomcat/commit/8bfb0ff / tomcat9
https://github.com/apache/tomcat/commit/8fbe2e9 / tomcat8
https://github.com/apache/tomcat/commit/702bf15 / tomcat7
--
You are receiving this mail because:
You are on the CC list for the bug.
6 days, 9 hours
[Bug 1831139] New: CVE-2020-9488 log4j: improper validation of certificate with host mismatch SMTP appender
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1831139
Bug ID: 1831139
Summary: CVE-2020-9488 log4j: improper validation of
certificate with host mismatch SMTP appender
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
ataylor(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bbuckingham(a)redhat.com,
bcourt(a)redhat.com, bdettelb(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cbyrne(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, cmacedo(a)redhat.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dbhole(a)redhat.com, decathorpe(a)gmail.com,
devrim(a)gunduz.org, dffrench(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
drieden(a)redhat.com, drusso(a)redhat.com,
dwalluck(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, ganandan(a)redhat.com,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
gvarsami(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, hhudgeon(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jclere(a)redhat.com,
jcoleman(a)redhat.com, jmadigan(a)redhat.com,
jochrist(a)redhat.com, jokerman(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschorr(a)redhat.com,
jshepherd(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kconner(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, ldimaggi(a)redhat.com,
lef(a)fedoraproject.org, lgao(a)redhat.com,
loleary(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com,
mbabacek(a)redhat.com, mizdebsk(a)redhat.com,
mmccune(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
ngough(a)redhat.com, nmoumoul(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pdrozd(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, pwright(a)redhat.com,
rchan(a)redhat.com, rguimara(a)redhat.com,
rjerrido(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rstancel(a)redhat.com,
rsvoboda(a)redhat.com, rsynek(a)redhat.com,
rwagner(a)redhat.com, sdaley(a)redhat.com,
smaestri(a)redhat.com, sochotni(a)redhat.com,
sokeeffe(a)redhat.com, spinder(a)redhat.com,
sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, tbrisker(a)redhat.com,
tcunning(a)redhat.com, theute(a)redhat.com,
tkirby(a)redhat.com, tlestach(a)redhat.com,
tomckay(a)redhat.com, tom.jenkinson(a)redhat.com,
trepel(a)redhat.com, weli(a)redhat.com
Target Milestone: ---
Classification: Other
Improper validation of certificate with host mismatch in Apache Log4j SMTP
appender. This could allow an SMTPS connection to be intercepted by a
man-in-the-middle attack which could leak any log messages sent through that
appender.
Reference:
https://issues.apache.org/jira/browse/LOG4J2-2819
--
You are receiving this mail because:
You are on the CC list for the bug.
1 week, 6 days
[Bug 1785711] New: CVE-2019-17563 tomcat: session fixation
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1785711
Bug ID: 1785711
Summary: CVE-2019-17563 tomcat: session fixation
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, alee(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
chazlett(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gzaronik(a)redhat.com,
ibek(a)redhat.com, ivan.afonichev(a)gmail.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jclere(a)redhat.com, jochrist(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, lgao(a)redhat.com,
mbabacek(a)redhat.com, mnovotny(a)redhat.com,
myarboro(a)redhat.com, paradhya(a)redhat.com,
pjindal(a)redhat.com, rhcs-maint(a)redhat.com,
rrajasek(a)redhat.com, rsynek(a)redhat.com,
sdaley(a)redhat.com, weli(a)redhat.com
Target Milestone: ---
Classification: Other
When using FORM authentication there was a narrow window where an attacker
could perform a session fixation attack. The window was considered too narrow
for an exploit to be practical but, erring on the side of caution, this issue
has been treated as a security vulnerability.
Reference:
https://tomcat.apache.org/security-7.html
https://tomcat.apache.org/security-8.html
http://tomcat.apache.org/security-9.html
Upstream commits:
https://github.com/apache/tomcat/commit/ab72a10
https://github.com/apache/tomcat/commit/e19a202
https://github.com/apache/tomcat/commit/1ecba14
--
You are receiving this mail because:
You are on the CC list for the bug.
1 week, 6 days