[Bug 1899943] New: F34FailsToInstall: apache-commons-chain
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1899943
Bug ID: 1899943
Summary: F34FailsToInstall: apache-commons-chain
Product: Fedora
Version: rawhide
Status: NEW
Component: apache-commons-chain
Assignee: jjelen(a)redhat.com
Reporter: mhroncok(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jjelen(a)redhat.com, mmraka(a)redhat.com,
puntogil(a)libero.it
Blocks: 1868279 (F34FailsToInstall)
Target Milestone: ---
Classification: Fedora
Hello,
Please note that this comment was generated automatically. If you feel that
this output has mistakes, please contact me via email (mhroncok(a)redhat.com).
Your package (apache-commons-chain) Fails To Install in Fedora 34:
can't install apache-commons-chain:
- nothing provides mvn(org.jboss.spec.javax.faces:jboss-jsf-api_2.1_spec)
needed by apache-commons-chain-1.2-24.fc33.noarch
If you know about this problem and are planning on fixing it, please
acknowledge so by setting the bug status to ASSIGNED. If you don't have time to
maintain this package, consider orphaning it, so maintainers of dependent
packages realize the problem.
If you don't react accordingly to the policy for FTBFS/FTI bugs
(https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fai...),
your package may be orphaned in 8+ weeks.
P.S. The data was generated solely from koji buildroot, so it might be newer
than the latest compose or the content on mirrors.
P.P.S. If this bug has been reported in the middle of upgrading multiple
dependent packages, please consider using side tags:
https://docs.fedoraproject.org/en-US/rawhide-gating/multi-builds/
Thanks!
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1868279
[Bug 1868279] (F34FailsToInstall) - Fedora 34 Fails To install Tracker
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 3 months
[Bug 1767170] New: jna-5.5.0 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1767170
Bug ID: 1767170
Summary: jna-5.5.0 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: jna
Keywords: FutureFeature, Triaged
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 5.5.0
Current version/release in rawhide: 5.4.0-1.fc31
URL: https://github.com/java-native-access/jna/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1464/
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 3 months
[Bug 1906616] New: nasm FTBFS in Rawhide (F34)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1906616
Bug ID: 1906616
Summary: nasm FTBFS in Rawhide (F34)
Product: Fedora
Version: rawhide
Status: NEW
Component: nasm
Assignee: igor.raits(a)gmail.com
Reporter: tdawson(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dominik(a)greysector.net, igor.raits(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, pbonzini(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
nasm no longer builds in Fedora Rawhide (F34).
Version-Release number of selected component (if applicable):
nasm-2.15.03-2
How reproducible:
Steps to Reproduce:
1. fedpkg clone nasm ; cd nasm
2. fedpkg build --scratch
3.
Actual results:
Build fails
Expected results:
Expect it to build.
Additional info:
That was found because of Fedora ELN. We are notifying you before the F34 mass
rebuild to give you more time to get this fixed.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 3 months
[Bug 1787312] New: Please, update to 3.2.6
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1787312
Bug ID: 1787312
Summary: Please, update to 3.2.6
Product: Fedora
Version: rawhide
Status: NEW
Component: mockito
Assignee: rkennke(a)redhat.com
Reporter: jjelen(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, mat.booth(a)redhat.com,
omajid(a)redhat.com, projects.rg(a)smart.ms,
rkennke(a)redhat.com, roman(a)fenkhuber.at
Target Milestone: ---
Classification: Fedora
The latest upstream version of mockito is 3.26, while fedora still sticks with
2.x, which is blocking updating some of the new packages to use the new
features.
https://site.mockito.org/
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 3 months
[Bug 1909897] New: Maven cannot be used with java-1.8.0
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1909897
Bug ID: 1909897
Summary: Maven cannot be used with java-1.8.0
Product: Fedora
Version: 33
Status: NEW
Component: maven
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: psppsn96(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
sochotni(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
Maven on F33 is compiled targeting a variant of Java greater than 1.8.0
(probably the new default: 11). It cannot be used with
java-1.8.0-openjdk-devel.
We must run maven with 1.8.0 to build our enterprise projects.
Version-Release number of selected component (if applicable):
maven-3.6.3-5.fc33.noarch
How reproducible:
Depends on task. 100% if ~/.m2/ is empty
Additional info:
Maven from apache.org works fine
(https://downloads.apache.org/maven/maven-3/3.6.3/binaries/apache-maven-3....).
Demonstration using RPM from F33 (note runtime used in each -version command):
kmarek@kyle-ppc64le ~/mvn-test
$ cat pom.xml
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>test</groupId>
<artifactId>test</artifactId>
<packaging>jar</packaging>
<version>1</version>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>
</project>
kmarek@kyle-ppc64le ~/mvn-test
$ rm -rf ~/.m2/
kmarek@kyle-ppc64le ~/mvn-test
$ java -version
openjdk version "1.8.0_275"
OpenJDK Runtime Environment (build 1.8.0_275-b01)
OpenJDK 64-Bit Server VM (build 25.275-b01, mixed mode)
kmarek@kyle-ppc64le ~/mvn-test
$ javac -version
javac 1.8.0_275
kmarek@kyle-ppc64le ~/mvn-test
$ mvn -version
Apache Maven 3.6.3 (Red Hat 3.6.3-5)
Maven home: /usr/share/maven
Java version: 11.0.9.1, vendor: Red Hat, Inc., runtime:
/usr/lib/jvm/java-11-openjdk-11.0.9.11-4.fc33.ppc64le
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "5.4.83-100.fc31.ppc64le", arch: "ppc64le", family:
"unix"
kmarek@kyle-ppc64le ~/mvn-test
$ JAVA_HOME=/usr/lib/jvm/java-1.8.0/ mvn -version
Apache Maven 3.6.3 (Red Hat 3.6.3-5)
Maven home: /usr/share/maven
Java version: 1.8.0_275, vendor: Red Hat, Inc., runtime:
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.275.b01-1.fc33.ppc64le/jre
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "5.4.83-100.fc31.ppc64le", arch: "ppc64le", family:
"unix"
kmarek@kyle-ppc64le ~/mvn-test
$ mvn -version
Apache Maven 3.6.3 (Red Hat 3.6.3-5)
Maven home: /usr/share/maven
Java version: 11.0.9.1, vendor: Red Hat, Inc., runtime:
/usr/lib/jvm/java-11-openjdk-11.0.9.11-4.fc33.ppc64le
Default locale: en_US, platform encoding: UTF-8
OS name: "linux", version: "5.4.83-100.fc31.ppc64le", arch: "ppc64le", family:
"unix"
kmarek@kyle-ppc64le ~/mvn-test
$ JAVA_HOME=/usr/lib/jvm/java-1.8.0/ mvn clean
[INFO] Scanning for projects...
[INFO]
[INFO] -----------------------------< test:test >------------------------------
[INFO] Building test 1
[INFO] --------------------------------[ jar ]---------------------------------
Downloading from central:
https://repo.maven.apache.org/maven2/org/apache/maven/plugins/maven-clean...
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 0.623 s
[INFO] Finished at: 2020-12-21T19:39:08-05:00
[INFO] ------------------------------------------------------------------------
---------------------------------------------------
constituent[0]: file:/usr/share/maven/conf/logging/
constituent[1]: file:/usr/share/maven/lib/jansi-1.17.1.jar
constituent[2]: file:/usr/share/maven/lib/maven-resolver-impl-1.4.1.jar
constituent[3]: file:/usr/share/maven/lib/plexus-cipher-1.7.jar
constituent[4]: file:/usr/share/maven/lib/hawtjni-runtime-1.17.jar
constituent[5]: file:/usr/share/maven/lib/maven-compat-3.6.3.jar
constituent[6]: file:/usr/share/maven/lib/maven-embedder-3.6.3.jar
constituent[7]: file:/usr/share/maven/lib/cdi-api-1.1.jar
constituent[8]: file:/usr/share/maven/lib/commons-cli-1.4.jar
constituent[9]: file:/usr/share/maven/lib/commons-codec-1.11.jar
constituent[10]: file:/usr/share/maven/lib/slf4j-api-1.7.29.jar
constituent[11]: file:/usr/share/maven/lib/wagon-http-3.3.4.jar
constituent[12]: file:/usr/share/maven/lib/maven-resolver-spi-1.4.1.jar
constituent[13]: file:/usr/share/maven/lib/httpcomponents_httpcore.jar
constituent[14]: file:/usr/share/maven/lib/guice-4.2.1-no_aop.jar
constituent[15]: file:/usr/share/maven/lib/jansi-linux.jar
constituent[16]: file:/usr/share/maven/lib/jsr250-api-1.0.jar
constituent[17]: file:/usr/share/maven/lib/maven-plugin-api-3.6.3.jar
constituent[18]: file:/usr/share/maven/lib/maven-resolver-provider-3.6.3.jar
constituent[19]: file:/usr/share/maven/lib/wagon-provider-api-3.3.4.jar
constituent[20]: file:/usr/share/maven/lib/maven-core-3.6.3.jar
constituent[21]: file:/usr/share/maven/lib/plexus-sec-dispatcher-1.4.jar
constituent[22]: file:/usr/share/maven/lib/plexus-interpolation-1.25.jar
constituent[23]: file:/usr/share/maven/lib/httpclient-4.5.12.jar
constituent[24]:
file:/usr/share/maven/lib/plexus-component-annotations-2.1.0.jar
constituent[25]: file:/usr/share/maven/lib/maven-slf4j-provider-3.6.3.jar
constituent[26]: file:/usr/share/maven/lib/org.eclipse.sisu.inject-0.3.4.jar
constituent[27]: file:/usr/share/maven/lib/maven-model-3.6.3.jar
constituent[28]: file:/usr/share/maven/lib/httpcomponents_httpclient.jar
constituent[29]: file:/usr/share/maven/lib/guava-27.1-jre.jar
constituent[30]: file:/usr/share/maven/lib/commons-lang3-3.8.1.jar
constituent[31]: file:/usr/share/maven/lib/maven-repository-metadata-3.6.3.jar
constituent[32]:
file:/usr/share/maven/lib/maven-resolver-transport-wagon-1.4.1.jar
constituent[33]: file:/usr/share/maven/lib/javax.inject-1.jar
constituent[34]: file:/usr/share/maven/lib/maven-resolver-api-1.4.1.jar
constituent[35]: file:/usr/share/maven/lib/maven-wagon_http-shared.jar
constituent[36]: file:/usr/share/maven/lib/org.eclipse.sisu.plexus-0.3.4.jar
constituent[37]: file:/usr/share/maven/lib/maven-settings-3.6.3.jar
constituent[38]: file:/usr/share/maven/lib/maven-settings-builder-3.6.3.jar
constituent[39]: file:/usr/share/maven/lib/wagon-file-3.3.4.jar
constituent[40]: file:/usr/share/maven/lib/wagon-http-shared-3.4.1.jar
constituent[41]: file:/usr/share/maven/lib/jsoup-1.12.1.jar
constituent[42]: file:/usr/share/maven/lib/maven-artifact-3.6.3.jar
constituent[43]: file:/usr/share/maven/lib/commons-io-2.5.jar
constituent[44]: file:/usr/share/maven/lib/maven-resolver-util-1.4.1.jar
constituent[45]: file:/usr/share/maven/lib/jcl-over-slf4j-1.7.29.jar
constituent[46]: file:/usr/share/maven/lib/maven-model-builder-3.6.3.jar
constituent[47]: file:/usr/share/maven/lib/plexus-utils-3.2.1.jar
constituent[48]: file:/usr/share/maven/lib/jansi-native-1.8.jar
constituent[49]:
file:/usr/share/maven/lib/maven-resolver-connector-basic-1.4.1.jar
constituent[50]: file:/usr/share/maven/lib/maven-builder-support-3.6.3.jar
constituent[51]: file:/usr/share/maven/lib/httpcore-4.4.13.jar
constituent[52]: file:/usr/share/maven/lib/maven-shared-utils-3.2.1.jar
---------------------------------------------------
Exception in thread "main" java.lang.NoSuchMethodError:
java.nio.ByteBuffer.flip()Ljava/nio/ByteBuffer;
at
org.apache.http.client.utils.URLEncodedUtils.urlDecode(URLEncodedUtils.java:682)
at
org.apache.http.client.utils.URLEncodedUtils.parsePathSegments(URLEncodedUtils.java:364)
at
org.apache.http.client.utils.URIBuilder.parsePath(URIBuilder.java:118)
at
org.apache.http.client.utils.URIBuilder.digestURI(URIBuilder.java:197)
at org.apache.http.client.utils.URIBuilder.<init>(URIBuilder.java:91)
at org.apache.http.client.utils.URIUtils.rewriteURI(URIUtils.java:206)
at
org.apache.http.client.utils.URIUtils.rewriteURIForRoute(URIUtils.java:319)
at
org.apache.http.impl.execchain.ProtocolExec.rewriteRequestURI(ProtocolExec.java:96)
at
org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:133)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
at
org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
at
org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
at
org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at
org.apache.maven.wagon.shared.http.AbstractHttpClientWagon.execute(AbstractHttpClientWagon.java:1005)
at
org.apache.maven.wagon.shared.http.AbstractHttpClientWagon.fillInputData(AbstractHttpClientWagon.java:1162)
at
org.apache.maven.wagon.shared.http.AbstractHttpClientWagon.fillInputData(AbstractHttpClientWagon.java:1140)
at
org.apache.maven.wagon.StreamWagon.getInputStream(StreamWagon.java:126)
at org.apache.maven.wagon.StreamWagon.getIfNewer(StreamWagon.java:88)
at org.apache.maven.wagon.StreamWagon.get(StreamWagon.java:61)
at
org.eclipse.aether.transport.wagon.WagonTransporter$GetTaskRunner.run(WagonTransporter.java:567)
at
org.eclipse.aether.transport.wagon.WagonTransporter.execute(WagonTransporter.java:435)
at
org.eclipse.aether.transport.wagon.WagonTransporter.get(WagonTransporter.java:412)
at
org.eclipse.aether.connector.basic.BasicRepositoryConnector$GetTaskRunner.runTask(BasicRepositoryConnector.java:457)
at
org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:364)
at
org.eclipse.aether.util.concurrency.RunnableErrorForwarder$1.run(RunnableErrorForwarder.java:75)
at
org.eclipse.aether.connector.basic.BasicRepositoryConnector$DirectExecutor.execute(BasicRepositoryConnector.java:644)
at
org.eclipse.aether.connector.basic.BasicRepositoryConnector.get(BasicRepositoryConnector.java:262)
at
org.eclipse.aether.internal.impl.DefaultArtifactResolver.performDownloads(DefaultArtifactResolver.java:499)
at
org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:401)
at
org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:229)
at
org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifact(DefaultArtifactResolver.java:207)
at
org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:240)
at
org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.readArtifactDescriptor(DefaultArtifactDescriptorReader.java:171)
at
org.eclipse.aether.internal.impl.DefaultRepositorySystem.readArtifactDescriptor(DefaultRepositorySystem.java:255)
at
org.apache.maven.plugin.internal.DefaultPluginDependenciesResolver.resolve(DefaultPluginDependenciesResolver.java:106)
at
org.apache.maven.plugin.internal.DefaultMavenPluginManager.getPluginDescriptor(DefaultMavenPluginManager.java:182)
at
org.apache.maven.plugin.internal.DefaultMavenPluginManager.getMojoDescriptor(DefaultMavenPluginManager.java:286)
at
org.apache.maven.plugin.DefaultBuildPluginManager.getMojoDescriptor(DefaultBuildPluginManager.java:244)
at
org.apache.maven.lifecycle.internal.DefaultLifecycleExecutionPlanCalculator.setupMojoExecution(DefaultLifecycleExecutionPlanCalculator.java:169)
at
org.apache.maven.lifecycle.internal.DefaultLifecycleExecutionPlanCalculator.setupMojoExecutions(DefaultLifecycleExecutionPlanCalculator.java:154)
at
org.apache.maven.lifecycle.internal.DefaultLifecycleExecutionPlanCalculator.calculateExecutionPlan(DefaultLifecycleExecutionPlanCalculator.java:130)
at
org.apache.maven.lifecycle.internal.DefaultLifecycleExecutionPlanCalculator.calculateExecutionPlan(DefaultLifecycleExecutionPlanCalculator.java:144)
at
org.apache.maven.lifecycle.internal.builder.BuilderCommon.resolveBuildPlan(BuilderCommon.java:97)
at
org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:111)
at
org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:81)
at
org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:56)
at
org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:128)
at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:305)
at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:192)
at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:105)
at org.apache.maven.cli.MavenCli.execute(MavenCli.java:957)
at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:289)
at org.apache.maven.cli.MavenCli.main(MavenCli.java:193)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:282)
at
org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:225)
at
org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:406)
at
org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:347)
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 3 months
[Bug 1905645] New: CVE-2020-17530 struts2: using forced OGNL evaluation on untrusted user input can lead to a RCE and security degradation
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1905645
Bug ID: 1905645
Summary: CVE-2020-17530 struts2: using forced OGNL evaluation
on untrusted user input can lead to a RCE and security
degradation
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, chazlett(a)redhat.com,
dbecker(a)redhat.com, dbhole(a)redhat.com,
drieden(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jjelen(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jschluet(a)redhat.com,
jwon(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
mburns(a)redhat.com, mkolesni(a)redhat.com,
mmraka(a)redhat.com, puntogil(a)libero.it,
sclewis(a)redhat.com, scohen(a)redhat.com,
slinaber(a)redhat.com
Target Milestone: ---
Classification: Other
Some of the tag's attributes could perform a double evaluation if a developer
applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL
evaluation on untrusted user input can lead to a Remote Code Execution and
security degradation.
Reference:
https://cwiki.apache.org/confluence/display/WW/S2-061
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months
[Bug 1821315] New: CVE-2020-11113 jackson-databind: jackson-databind: mishandles the interaction between serialization gadgets and typing related to org.apache.openjpa.ee.WASRegistryManagedRuntime which could result in remote command execution
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1821315
Bug ID: 1821315
Summary: CVE-2020-11113 jackson-databind: jackson-databind:
mishandles the interaction between serialization
gadgets and typing related to
org.apache.openjpa.ee.WASRegistryManagedRuntime which
could result in remote command execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mkaplan(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
aos-bugs(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, ataylor(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bkearney(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
darran.lofthouse(a)redhat.com, dbecker(a)redhat.com,
decathorpe(a)gmail.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ganandan(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, hhudgeon(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcantril(a)redhat.com,
jjoyce(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jschatte(a)redhat.com, jschluet(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kbasil(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lef(a)fedoraproject.org, lgao(a)redhat.com,
lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com,
lzap(a)redhat.com, mburns(a)redhat.com,
mkolesni(a)redhat.com, mmccune(a)redhat.com,
mnovotny(a)redhat.com, msochure(a)redhat.com,
msvehla(a)redhat.com, mszynkie(a)redhat.com,
nmoumoul(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pdrozd(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
psotirop(a)redhat.com, puntogil(a)libero.it,
rchan(a)redhat.com, rguimara(a)redhat.com,
rhcs-maint(a)redhat.com, rjerrido(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
sokeeffe(a)redhat.com, sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, swoodman(a)redhat.com,
tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com,
vhalbert(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jackson-databind 2.x before 2.9.10.4 mishandles
the interaction between serialization gadgets and typing, related to
org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 4 months