[Bug 1819818] New: Please package fop for epel-8
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819818
Bug ID: 1819818
Summary: Please package fop for epel-8
Product: Fedora EPEL
Version: epel8
Hardware: All
OS: Linux
Status: NEW
Component: fop
Severity: medium
Assignee: rlandman(a)redhat.com
Reporter: TicoTimo(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: c.david86(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, rhbugs(a)n-dimensional.de,
rlandman(a)redhat.com, tim(a)tim-landscheidt.de
Target Milestone: ---
Classification: Fedora
fop was available in CentOS-7:
http://mirror.centos.org/centos/7/os/x86_64/Packages/fop-1.1-6.el7.noarch...
It is still available Fedora.
This is the one package missing from claiming full support for CentOS-8 for
Yocto Project (documentation build depends on fop).
NOTE: I am willing to work on this as a co-maintainer. fas: ttorling
-------------
Naively cloning f30 branch and performing a local build (on CentOS-8)
(fop-2.2):
ant is available as module
error: Failed build dependencies:
apache-commons,
avalon-framework,
batik,
fontbox,
javapackages-local,
junit,
qdox,
servlet,
xmlgraphics-commons,
xmlunit
Similar for f32 branch (fop-2.4).
error: Failed build dependencies:
apache-commons-io
apache-commons-logging
batik
fontbox
javapackages-local
junit
qdox
servlet
xmlgraphics-commons
xmlunit
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year
[Bug 1807472] New: jflex-1.8.0 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1807472
Bug ID: 1807472
Summary: jflex-1.8.0 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: jflex
Keywords: FutureFeature, Triaged
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, decathorpe(a)gmail.com,
jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 1.8.0
Current version/release in rawhide: 1.7.0-2.fc32
URL: http://jflex.de/download.html
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1449/
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year
[Bug 1818177] New: xmlstreambuffer-2.0.0-M1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1818177
Bug ID: 1818177
Summary: xmlstreambuffer-2.0.0-M1 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: xmlstreambuffer
Keywords: FutureFeature, Triaged
Assignee: decathorpe(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
lef(a)fedoraproject.org, puntogil(a)libero.it,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 2.0.0-M1
Current version/release in rawhide: 1.5.4-11.fc32
URL: https://javaee.github.io/metro-xmlstreambuffer/
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/89340/
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 2 months
[Bug 1860184] New: xbean-4.17 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1860184
Bug ID: 1860184
Summary: xbean-4.17 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: xbean
Keywords: FutureFeature, Triaged
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
jjelen(a)redhat.com, krzysztof.daniel(a)gmail.com,
mizdebsk(a)redhat.com, sochotni(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 4.17
Current version/release in rawhide: 4.15-2.fc32
URL: https://geronimo.apache.org/xbean/index.html
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/5162/
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 6 months
[Bug 1745960] New: Request to build tomcat for EPEL 8
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1745960
Bug ID: 1745960
Summary: Request to build tomcat for EPEL 8
Product: Fedora EPEL
Version: el6
Status: NEW
Component: tomcat
Assignee: ivan.afonichev(a)gmail.com
Reporter: adam.winberg(a)smhi.se
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Fedora
Tomcat is not available from official Red Hat repos in RHEL8, so no conflict
should exist?
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 6 months
[Bug 1838332] New: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1838332
Bug ID: 1838332
Summary: CVE-2020-9484 tomcat: Apache Tomcat Remote Code
Execution via session persistence
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: jwon(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bgeorges(a)redhat.com,
bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmoulliard(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, ibek(a)redhat.com,
ikanello(a)redhat.com, ivan.afonichev(a)gmail.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jolee(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lthon(a)redhat.com, mbabacek(a)redhat.com,
mburns(a)redhat.com, mizdebsk(a)redhat.com,
mkolesni(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
rguimara(a)redhat.com, rhcs-maint(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com,
weli(a)redhat.com
Target Milestone: ---
Classification: Other
A flaw was found in the Apache Tomcat, where session persistence in using
PersistenceManager with a FileStore.
If:
a) an attacker is able to control the contents and name of a file on the
server; and
b) the server is configured to use the PersistenceManager with a
FileStore; and
c) the PersistenceManager is configured with
sessionAttributeValueClassNameFilter="null" (the default unless a
SecurityManager is used) or a sufficiently lax filter to allow the
attacker provided object to be deserialized; and
d) the attacker knows the relative file path from the storage location
used by FileStore to the file the attacker has control over;
then, using a specifically crafted request, the attacker will be able to
trigger remote code execution via deserialization of the file under
their control. Note that all of conditions a) to d) must be true for the
attack to succeed.
It affects the version of Apache Tomcat 10 before 10.0.0-M4, Apache Tomcat 9
before 9.0.34, Tomcat 8 before 8.5.54, and Tomcat 7 before 7.0.103.
Upstream commits:
Tomcat 10.0:
https://github.com/apache/tomcat/commit/bb33048e3f9b4f2b70e4da2e6c4e34ca8...
Tomcat 9.0:
https://github.com/apache/tomcat/commit/3aa8f28db7efb311cdd1b6fe15a9cd3b1...
Tomcat 8.5:
https://github.com/apache/tomcat/commit/ec08af18d0f9ddca3f2d800ef66fe7fd2...
Tomcat 7.0:
https://github.com/apache/tomcat/commit/53e30390943c18fca0c9e57dbcc14f1c6...
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 8 months
[Bug 1857024] New: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1857024
Bug ID: 1857024
Summary: CVE-2020-13935 tomcat: multiple requests with invalid
payload length in a WebSocket frame could lead to DoS
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: jwon(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
alee(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, asoldano(a)redhat.com,
atangrin(a)redhat.com, avibelli(a)redhat.com,
bbaranow(a)redhat.com, bgeorges(a)redhat.com,
bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
cmoulliard(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, darran.lofthouse(a)redhat.com,
dbecker(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, gzaronik(a)redhat.com,
hhorak(a)redhat.com, huwang(a)redhat.com, ibek(a)redhat.com,
ikanello(a)redhat.com, ivan.afonichev(a)gmail.com,
iweiss(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jclere(a)redhat.com, jjoyce(a)redhat.com,
jochrist(a)redhat.com, jolee(a)redhat.com,
jorton(a)redhat.com, jpallich(a)redhat.com,
jperkins(a)redhat.com, jschatte(a)redhat.com,
jschluet(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kbasil(a)redhat.com,
krathod(a)redhat.com, krzysztof.daniel(a)gmail.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com,
lthon(a)redhat.com, mbabacek(a)redhat.com,
mburns(a)redhat.com, mizdebsk(a)redhat.com,
mkolesni(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nwallace(a)redhat.com, paradhya(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
rguimara(a)redhat.com, rhcs-maint(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, sclewis(a)redhat.com,
scohen(a)redhat.com, sdaley(a)redhat.com,
slinaber(a)redhat.com, smaestri(a)redhat.com,
tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com,
weli(a)redhat.com
Blocks: 1857013
Target Milestone: ---
Classification: Other
A flaw was found in the Apache Tomcat, where the payload length in a WebSocket
frame was not correctly validated. Invalid payload lengths could trigger an
infinite loop. Multiple requests with invalid payload lengths could lead to a
denial of service.
It affects the version of Apache Tomcat 10.0.0-M1 to 10.0.0-M6, Apache Tomcat
9.0.0.M1 to 9.0.36, Apache Tomcat 8.5.0 to 8.5.56, and Apache Tomcat 7.0.27 to
7.0.104.
Upstream commits:
Tomcat 10.0:
https://github.com/apache/tomcat/commit/1c1c77b0efb667cea80b532440b44cea1...
Tomcat 9.0:
https://github.com/apache/tomcat/commit/40fa74c74822711ab878079d0a69f7357...
Tomcat 8.5:
https://github.com/apache/tomcat/commit/12d715676038efbf9c728af10163f8277...
Tomcat 7.0:
https://github.com/apache/tomcat/commit/f9f75c14678b68633f79030ddf4ff827f...,
https://github.com/apache/tomcat/commit/4c04982870d6e730c38e21e58fb653b7c...
Reference:
http://mail-archives.apache.org/mod_mbox/tomcat-announce/202007.mbox/%3C3...
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 9 months
[Bug 1785616] New: CVE-2019-17571 log4j: deserialization of untrusted data in SocketServer
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1785616
Bug ID: 1785616
Summary: CVE-2019-17571 log4j: deserialization of untrusted
data in SocketServer
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: urgent
Priority: urgent
Assignee: security-response-team(a)redhat.com
Reporter: msiddiqu(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bdettelb(a)redhat.com, bgeorges(a)redhat.com,
bkearney(a)redhat.com, bmaxwell(a)redhat.com,
bmontgom(a)redhat.com, brian.stansberry(a)redhat.com,
cbyrne(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, cmacedo(a)redhat.com,
darran.lofthouse(a)redhat.com, dbhole(a)redhat.com,
decathorpe(a)gmail.com, devrim(a)gunduz.org,
dffrench(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
drusso(a)redhat.com, dwalluck(a)redhat.com,
eparis(a)redhat.com, etirelli(a)redhat.com,
ggaughan(a)redhat.com, gvarsami(a)redhat.com,
hhorak(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jawilson(a)redhat.com, jbalunas(a)redhat.com,
jburrell(a)redhat.com, jcoleman(a)redhat.com,
jmadigan(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jorton(a)redhat.com,
jpallich(a)redhat.com, jperkins(a)redhat.com,
jschorr(a)redhat.com, jshepherd(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lef(a)fedoraproject.org,
lgao(a)redhat.com, loleary(a)redhat.com, lthon(a)redhat.com,
mizdebsk(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, ngough(a)redhat.com,
nstielau(a)redhat.com, nwallace(a)redhat.com,
paradhya(a)redhat.com, pdrozd(a)redhat.com,
pgallagh(a)redhat.com, pjindal(a)redhat.com,
pmackay(a)redhat.com, psotirop(a)redhat.com,
puntogil(a)libero.it, pwright(a)redhat.com,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
rruss(a)redhat.com, rsvoboda(a)redhat.com,
rsynek(a)redhat.com, rwagner(a)redhat.com,
sdaley(a)redhat.com, smaestri(a)redhat.com,
sochotni(a)redhat.com, spinder(a)redhat.com,
sponnaga(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org,
sthorger(a)redhat.com, tcunning(a)redhat.com,
theute(a)redhat.com, tkirby(a)redhat.com,
tlestach(a)redhat.com, tomckay(a)redhat.com,
tom.jenkinson(a)redhat.com, trepel(a)redhat.com
Target Milestone: ---
Classification: Other
Included in Log4j 1.2 is a SocketServer class that is vulnerable to
deserialization of untrusted data which can be exploited to remotely
execute arbitrary code when combined with a deserialization gadget
when listening to untrusted network traffic for log data.
References:
https://logging.apache.org/log4j/1.2/
https://issues.apache.org/jira/browse/LOG4J2-1863
--
You are receiving this mail because:
You are on the CC list for the bug.
1 year, 9 months