[Bug 1809554] New: jackson-core-2.10.3 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1809554
Bug ID: 1809554
Summary: jackson-core-2.10.3 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: jackson-core
Keywords: FutureFeature, Triaged
Assignee: decathorpe(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it, roman(a)fenkhuber.at,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 2.10.3
Current version/release in rawhide: 2.10.2-2.fc32
URL: http://wiki.fasterxml.com/JacksonHome
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/10962/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1800880] New: apache-commons-compress-1.20 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1800880
Bug ID: 1800880
Summary: apache-commons-compress-1.20 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: apache-commons-compress
Keywords: FutureFeature, Triaged
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jjelen(a)redhat.com, mizdebsk(a)redhat.com,
mkoncek(a)redhat.com, SpikeFedora(a)gmail.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 1.20
Current version/release in rawhide: 1.19-2.fc32
URL: http://commons.apache.org/proper/commons-compress/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/62/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1785864] New: felix-utils-1.11.4 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1785864
Bug ID: 1785864
Summary: felix-utils-1.11.4 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: felix-utils
Keywords: FutureFeature, Triaged
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com, jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mhroncok(a)redhat.com, mizdebsk(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 1.11.4
Current version/release in rawhide: 1.11.2-1.fc32
URL: http://www.apache.org/dist/felix/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/799/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1794976] New: apache-parent-23 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1794976
Bug ID: 1794976
Summary: apache-parent-23 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: apache-parent
Keywords: FutureFeature, Triaged
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: agrimm(a)gmail.com, ctubbsii(a)fedoraproject.org,
decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mhroncok(a)redhat.com, mizdebsk(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 23
Current version/release in rawhide: 22-1.fc32
URL: https://maven.apache.org/pom/asf/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/20383/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1782296] New: plexus-pom-6.0 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1782296
Bug ID: 1782296
Summary: plexus-pom-6.0 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: plexus-pom
Keywords: FutureFeature, Triaged
Assignee: decathorpe(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, puntogil(a)libero.it,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 6.0
Current version/release in rawhide: 5.1-1.fc32
URL: https://github.com/codehaus-plexus/plexus-pom
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/20412/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1782284] New: woodstox-core-6.0.3 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1782284
Bug ID: 1782284
Summary: woodstox-core-6.0.3 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: woodstox-core
Keywords: FutureFeature, Triaged
Assignee: decathorpe(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com, jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 6.0.3
Current version/release in rawhide: 6.0.2-1.fc32
URL: https://github.com/FasterXML/woodstox
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/5140/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1808641] New: log4j-2.13.1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1808641
Bug ID: 1808641
Summary: log4j-2.13.1 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: log4j
Keywords: FutureFeature, Triaged
Assignee: decathorpe(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, decathorpe(a)gmail.com,
devrim(a)gunduz.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, sochotni(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 2.13.1
Current version/release in rawhide: 2.13.0-3.fc33
URL: http://www.apache.org/dist/logging/log4j
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1836/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1808753] New: plexus-archiver-4.2.2 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1808753
Bug ID: 1808753
Summary: plexus-archiver-4.2.2 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: plexus-archiver
Keywords: FutureFeature, Triaged
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, decathorpe(a)gmail.com,
jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mhroncok(a)redhat.com, mizdebsk(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 4.2.2
Current version/release in rawhide: 4.2.1-2.fc32
URL: http://codehaus-plexus.github.io/plexus-archiver
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/3655/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1806398] CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1806398
--- Comment #71 from Ted (Jong Seok) Won <jwon(a)redhat.com> ---
Mitigation:
The issue can be mitigated as follows:
For JWS(Tomcat),
If your site is not actively using the AJP Connector, simply comment it out
from the <TOMCAT_HOME>/conf/server.xml file as
~~~
<!-- <Connector port = "8009" protocol = "AJP / 1.3" redirectPort = "8443"
/> -->
~~~
If AJP connector is required and cannot be commented/deactivated, then we
recommend to set a secret password for the AJP conduit - Only requests from
workers with the same secret keyword will be accepted. At the Tomcat side, edit
conf/server.xml:
~~~
<Connector port = "8009"
protocol = "AJP / 1.3"
redirectPort = "8443"
address = "YOUR_TOMCAT_IP_ADDRESS"
requiredSecret = "YOUR_AJP_SECRET" />
~~~
For JBoss EAP 6.4 (JBossWeb 7.x),
The AJP connector is enabled by default only in standalone-full-ha.xml,
standalone-ha.xml and ha and full-ha profiles in domain.xml. AJP connector can
be secured as follows:
If you do not use AJP, you can disable the AJP port configuration in your
standalone-*.xml and/or domain.xml file by setting enabled="false" as shown
below or comment out the whole <connector name="AJP" .../> clause:
~~~
<connector name="AJP" protocol="AJP/1.3" scheme="http" socket-binding="ajp"
enabled="false"/>
~~~
If AJP connector is a requirement and cannot be commented or deactivated,
then, it is recommended to add credential to AJP connector by configuring the
following system property.
~~~
<system-properties>
<property name="org.apache.coyote.ajp.DEFAULT_REQUIRED_SECRET"
value="YOUR_AJP_SECRET"/>
</system-properties>
~~~
Note that YOUR_AJP_SECRET must be changed to a value that is highly secure and
cannot be easily guessed.
For Apache httpd (httpd in JBCS or RHEL),
When the above setting is configured, the same secret value on the front-end
proxy (mod_proxy or mod_jk) will be required to be configured.
* mod_proxy (mod_proxy_ajp / mod_proxy_balancer using ajp)
The secret property support was added since JBCS httpd 2.4.37 or since RHEL
7 httpd-2.4.6-67.el7.x86_641.[1]
For mod_proxy_ajp, the secret property can be added to ProxyPass
setting.
For mod_proxy_balancer, the secret property can be added to each
BalancerMember setting.
For example, add secret=YOUR_AJP_SECRET in your configuration (e.g.
<HTTPD_HOME>/conf/httpd.conf or <HTTPD_HOME>/conf.d/proxy_ajp.conf) like the
following:
- mod_proxy_ajp:
~~~
ProxyPass /example/ ajp://localhost:8009/example/ secret=YOUR_AJP_SECRET
~~~
- mod_proxy_balancer:
~~~
<Proxy balancer://mycluster>
BalancerMember ajp://node1:8009 route=node1 secret=YOUR_AJP_SECRET
BalancerMember ajp://node2:8009 route=node2 secret=YOUR_AJP_SECRET
</Proxy>
ProxyPass /example/ balancer://mycluster/example/
stickysession=JSESSIONID|jsessionid
~~~
* mod_jk
mod_jk - secret can be specified to a worker or a load balancer in
workers.properties. If you set a secret on a load balancer, all its members
will inherit this secret. This secret property support was added in mod_jk
1.2.12 onwards.
For example, add the following in your workers.properties:
~~~
worker.<WORKER_NAME>.secret=YOUR_AJP_SECRET
~~~
Ensure that WORKER_NAME must be replaced with the appropriate name.
* mod_cluster
mod_cluster does not support secret property.[2] When secret is configured
on the AJP connector in Tomcat/JBoss side, you can not connect AJP without a
correct secret value. So, you need to use http or https for mod_cluster.
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1397241
[2] https://docs.modcluster.io/#migration-from-modjk
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month
[Bug 1803416] New: plexus-compiler-2.8.6 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1803416
Bug ID: 1803416
Summary: plexus-compiler-2.8.6 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: plexus-compiler
Keywords: FutureFeature, Triaged
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, sochotni(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 2.8.6
Current version/release in rawhide: 2.8.5-2.fc32
URL: https://github.com/codehaus-plexus/plexus-compiler
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/9003/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years, 1 month