[Bug 1883897] New: ant-1.10.9 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1883897
Bug ID: 1883897
Summary: ant-1.10.9 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: ant
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com, jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 1.10.9
Current version/release in rawhide: 1.10.8-6.fc34
URL: https://ant.apache.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/50/
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 6 months
[Bug 1883751] New: F33 maven is failing at basic tasks like openliberty: java.lang.ExceptionInInitializerError in plugins
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1883751
Bug ID: 1883751
Summary: F33 maven is failing at basic tasks like openliberty:
java.lang.ExceptionInInitializerError in plugins
Product: Fedora
Version: 33
Status: NEW
Component: maven
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: shihping.chan(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
sochotni(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
Using F33 maven is failing in
openliberty guide-getting-started liberty:dev goal
Version-Release number of selected component (if applicable):
maven-3.6.3-4.fc33.noarch
java-11-openjdk-11.0.9.6-0.0.ea.fc33.x86_64
How reproducible:
Always
Steps to Reproduce:
1. git clone https://github.com/openliberty/guide-getting-started.git
2. mvn -X liberty:dev
3.
Actual results:
An API incompatibility was encountered while executing
io.openliberty.tools:liberty-maven-plugin:3.2:dev:
java.lang.ExceptionInInitializerError: null
Failed to execute goal io.openliberty.tools:liberty-maven-plugin:3.2:dev
(default-cli) on project guide-getting-started: Could not get the highest
version from the range: [19.0.0.6,): Unable to resolve version range fram
io.openliberty:openliberty-kernel:zip:[19.0.0.6,) -> [Help 1]
Expected results:
Executing phases/goals succeeds
Additional info:
1. Using upstream apache-maven-3.6.3 works.
2. If you use upstream maven to run the goal (liberty:dev) once, which sets up
the in-tree application server, and then use F33's maven to rerun the goal it
works
3. I have observed this in other projects like wildfly, i.e., use F33 mvn until
hitting some java/maven-plugin Exception, switch to upstream mvn to cross this
hurdle, then switch back to F33 mvn. After a few iterations, F33 mvn will
generally the goal succesfully.
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 6 months
[Bug 1819652] New: CVE-2019-16538 jenkins-script-security-plugin: sandbox protection bypass leads to execute arbitrary code in sandboxed scripts
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819652
Bug ID: 1819652
Summary: CVE-2019-16538 jenkins-script-security-plugin: sandbox
protection bypass leads to execute arbitrary code in
sandboxed scripts
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and
earlier related to the handling of default parameter expressions in closures
allowed attackers to execute arbitrary code in sandboxed scripts.
Reference:
http://www.openwall.com/lists/oss-security/2019/11/21/1
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 6 months
[Bug 1819078] New: CVE-2020-2135 jenkins-2-plugins: sandbox protection bypass leads to arbitrary code execution
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819078
Bug ID: 1819078
Summary: CVE-2020-2135 jenkins-2-plugins: sandbox protection
bypass leads to arbitrary code execution
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins Script Security Plugin 1.70 and earlier,
where sandbox protection earlier could be circumvented through crafted method
calls on objects that implement GroovyInterceptable.
Reference:
http://www.openwall.com/lists/oss-security/2020/03/09/1
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 6 months
[Bug 1819093] New: CVE-2020-2110 jenkins-2-plugins: sandbox protection bypass during script compilation phase by applying AST transforming annotations
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819093
Bug ID: 1819093
Summary: CVE-2020-2110 jenkins-2-plugins: sandbox protection
bypass during script compilation phase by applying AST
transforming annotations
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins Script Security Plugin 1.69 and earlier,
where sandbox protection could be circumvented during the script compilation
phase by applying AST transforming annotations to imports or by using them
inside of other annotations.
Reference:
http://www.openwall.com/lists/oss-security/2020/02/12/3
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 6 months
[Bug 1819091] New: CVE-2020-2134 jenkins-2-plugins: sandbox protection bypass via crafted constructor calls and crafted constructor bodies
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819091
Bug ID: 1819091
Summary: CVE-2020-2134 jenkins-2-plugins: sandbox protection
bypass via crafted constructor calls and crafted
constructor bodies
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins Script Security Plugin 1.70 and earlier,
where sandbox protection could be circumvented through crafted constructor
calls and crafted constructor bodies.
Reference:
http://www.openwall.com/lists/oss-security/2020/03/09/1
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 6 months
[Bug 1819190] New: CVE-2020-2160 jenkins: CSRF protection bypass via crafted URLs
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819190
Bug ID: 1819190
Summary: CVE-2020-2160 jenkins: CSRF protection bypass via
crafted URLs
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: abenaiss(a)redhat.com, aos-bugs(a)redhat.com,
bmontgom(a)redhat.com, eparis(a)redhat.com,
extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jokerman(a)redhat.com,
mizdebsk(a)redhat.com, msrb(a)redhat.com,
nstielau(a)redhat.com, pbhattac(a)redhat.com,
sponnaga(a)redhat.com, vbobade(a)redhat.com
Target Milestone: ---
Classification: Other
A vulnerability was found in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier
uses different representations of request URL paths, which allows attackers to
craft URLs that allow bypassing CSRF protection of any target URL.
Reference:
http://www.openwall.com/lists/oss-security/2020/03/25/2
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 6 months
[Bug 1655502] zxing-3.4.1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1655502
--- Comment #3 from Upstream Release Monitoring <upstream-release-monitoring(a)fedoraproject.org> ---
The following Sources of the specfile are not valid URLs so we cannot
automatically build the new version for you. Please use URLs in your Source
declarations if possible.
- zxing-3.4.1.tar.xz
- zxing-repack.sh
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 7 months