[Bug 1767483] New: CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1767483
Bug ID: 1767483
Summary: CVE-2019-10086 apache-commons-beanutils: does not
suppresses the class property in PropertyUtilsBean by
default
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: bkearney(a)redhat.com, dblechte(a)redhat.com,
decathorpe(a)gmail.com, dfediuck(a)redhat.com,
eedri(a)redhat.com, fnasser(a)redhat.com,
hhorak(a)redhat.com, java-maint(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jorton(a)redhat.com, mgoldboi(a)redhat.com,
mhroncok(a)redhat.com, michal.skrivanek(a)redhat.com,
mizdebsk(a)redhat.com, omajid(a)redhat.com,
qe-baseos-apps(a)redhat.com, sbonazzo(a)redhat.com,
sgehwolf(a)redhat.com, sherold(a)redhat.com,
SpikeFedora(a)gmail.com,
stewardship-sig(a)lists.fedoraproject.org,
tlestach(a)redhat.com, yturgema(a)redhat.com
Target Milestone: ---
Classification: Other
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added
which allows suppressing the ability for an attacker to access the classloader
via the class property available on all Java objects. We, however were not
using this by default characteristic of the PropertyUtilsBean.
Reference:
http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628...
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 6 months
[Bug 1990050] New: Provide xstream for EPEL-8
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1990050
Bug ID: 1990050
Summary: Provide xstream for EPEL-8
Product: Fedora
Version: rawhide
OS: Linux
Status: NEW
Component: xstream
Assignee: dchen(a)redhat.com
Reporter: redhat.com(a)bluhm-de.com
QA Contact: extras-qa(a)fedoraproject.org
CC: dchen(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
lkundrak(a)v3.sk, mizdebsk(a)redhat.com
Target Milestone: ---
Link ID: Red Hat Bugzilla 1990019
Classification: Fedora
Currently, there is no xstream version shipped in EPEL-8 (or RHEL
Base/Appstream).
Can you please release an xstream package to EPEL-8?
Thank you.
Dependent request: xpp3 (bz #1990019)
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 7 months
[Bug 1950667] New: ant-1.10.10 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1950667
Bug ID: 1950667
Summary: ant-1.10.10 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: ant
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com, jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, msrb(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 1.10.10
Current version/release in rawhide: 1.10.9-2.fc34
URL: https://ant.apache.org/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/50/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 7 months
[Bug 652183] Java SIG tracker bug
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=652183
--- Comment #8 from Mikolaj Izdebski <mizdebsk(a)redhat.com> ---
This tracker is used mostly for package reviews, which are not tied to any
particular Fedora release. Moreover, this bug is not used very often these
days, so it's easy to see what is going on. In case this bug starts to be
frequently used again, we can split it into more tracker bugs - per release,
per area of interest or in some other way.
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=652183
2 years, 7 months
[Bug 652183] Java SIG tracker bug
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=652183
--- Comment #7 from Alexander Kurtakov <akurtako(a)redhat.com> ---
As someone that has used tracking bugs upstream for more than a decade - it's
far more constructive to have one such tracking bug per release as it gives
better view of what is really being worked on rather than abstract poluted by
too many years of changes bug. As I'm not doing anything here I'm just sharing
my experience nothing more :)
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=652183
2 years, 7 months
[Bug 1993621] New: Provide snakeyaml for EPEL-8
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1993621
Bug ID: 1993621
Summary: Provide snakeyaml for EPEL-8
Product: Fedora
Version: rawhide
OS: Linux
Status: NEW
Component: snakeyaml
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: fedoraproject.org(a)bluhm-de.com
QA Contact: extras-qa(a)fedoraproject.org
CC: jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, mizdebsk(a)redhat.com, mo(a)morsi.org
Target Milestone: ---
Classification: Fedora
Currently, there is no snakeyaml version shipped in EPEL-8 (or RHEL
Base/Appstream).
Can you please release an snakeyaml package to EPEL-8?
I would also be happy to take ownership.
Thank you.
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 7 months
[Bug 652183] Java SIG tracker bug
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=652183
Mikolaj Izdebski <mizdebsk(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|CLOSED |NEW
Depends On|826037, 832853, 837450, |
|846561, 849496, 968136, |
|969271, 1022024, 1110070, |
|1111373, 1149176, 1152246, |
|1190740, 1190746, 1197048, |
|1201028, 1202231, 1202504, |
|1211659, 1221474, 1240475, |
|1260975, 1272787, 1282222, |
|1289726, 1363923, 1369227, |
|1421366 (MSearch), 1426243 |
|(MediathekView), 1467716 |
Resolution|CURRENTRELEASE |---
Keywords| |Reopened
--- Comment #6 from Mikolaj Izdebski <mizdebsk(a)redhat.com> ---
(In reply to Didik Supriadi from comment #5)
> Since Kanban is not used anymore, Could this bug be used for tracking java
> related reviews again?
Sure! We can start using it again.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=826037
[Bug 826037] Review Request: prefuse - Java Visualization Toolkit
https://bugzilla.redhat.com/show_bug.cgi?id=832853
[Bug 832853] Review Request: java3d - Java 3D
https://bugzilla.redhat.com/show_bug.cgi?id=837450
[Bug 837450] Review Request: android-java - Google Android Java Library
https://bugzilla.redhat.com/show_bug.cgi?id=846561
[Bug 846561] Review Request: groovy-gram - A metadata processing engine for
Groovy
https://bugzilla.redhat.com/show_bug.cgi?id=849496
[Bug 849496] Review Request: webbit - Event-based WebSocket and HTTP server for
Java
https://bugzilla.redhat.com/show_bug.cgi?id=968136
[Bug 968136] Review Request: camel - Apache Camel integration framework
https://bugzilla.redhat.com/show_bug.cgi?id=969271
[Bug 969271] Review Request: cometd - A scalable HTTP-based event routing bus
https://bugzilla.redhat.com/show_bug.cgi?id=1022024
[Bug 1022024] Remove versioned jar files/symlinks from non-compat packages
https://bugzilla.redhat.com/show_bug.cgi?id=1110070
[Bug 1110070] Review Request: vert.x - A lightweight, high-performance,
polyglot, event-driven application platform for JVM
https://bugzilla.redhat.com/show_bug.cgi?id=1111373
[Bug 1111373] Review Request: ant18 - ant version 1.8 for EL6
https://bugzilla.redhat.com/show_bug.cgi?id=1149176
[Bug 1149176] Review Request: vdsm-jsonrpc-java - jsonrpc communication lib for
ovirt
https://bugzilla.redhat.com/show_bug.cgi?id=1152246
[Bug 1152246] Review Request: joda-timezones - Timezone data for joda-time
https://bugzilla.redhat.com/show_bug.cgi?id=1190740
[Bug 1190740] Review Request: mycila-xmltool - simple library to do common
operations on xml
https://bugzilla.redhat.com/show_bug.cgi?id=1190746
[Bug 1190746] Review Request: mycila-license-maven-plugin - Manage license
header of your project
https://bugzilla.redhat.com/show_bug.cgi?id=1197048
[Bug 1197048] Review Request: felix-ipojo-metadata - Apache Felix iPOJO
Metadata
https://bugzilla.redhat.com/show_bug.cgi?id=1201028
[Bug 1201028] Review Request: twitter-util - Miscellaneous Idiomatic Scala
Utilities & Wrappers
https://bugzilla.redhat.com/show_bug.cgi?id=1202231
[Bug 1202231] Review Request: jbehave - Behavior-Driven Development framework
for Java and Groovy
https://bugzilla.redhat.com/show_bug.cgi?id=1202504
[Bug 1202504] Review Request: jsontools - Java Tools for the JSON Format
https://bugzilla.redhat.com/show_bug.cgi?id=1211659
[Bug 1211659] Review Request: utils-zookeeper - Utilities and wrappers around
ZooKeeper
https://bugzilla.redhat.com/show_bug.cgi?id=1221474
[Bug 1221474] Review Request: rrd4j - A high performance data logging and
graphing system for time series data
https://bugzilla.redhat.com/show_bug.cgi?id=1240475
[Bug 1240475] Review Request: foundrylogic-vpp - Velocity Preprocessor
https://bugzilla.redhat.com/show_bug.cgi?id=1260975
[Bug 1260975] Review Request: uimafit - Factories, Injection, and Testing
library for Apache UIMA
https://bugzilla.redhat.com/show_bug.cgi?id=1272787
[Bug 1272787] Review Request: springframework-shell - Spring based interactive
shell
https://bugzilla.redhat.com/show_bug.cgi?id=1282222
[Bug 1282222] Review Request: tggraphlayout - The layout library of the
Touchgraph project
https://bugzilla.redhat.com/show_bug.cgi?id=1289726
[Bug 1289726] Review Request: apache-commons-weaver - Apache Commons Weaver
https://bugzilla.redhat.com/show_bug.cgi?id=1363923
[Bug 1363923] Review Request: springframework4 - Spring Java Application
Framework
https://bugzilla.redhat.com/show_bug.cgi?id=1369227
[Bug 1369227] Review Request: pcollections - A Persistent Java Collections
Library
https://bugzilla.redhat.com/show_bug.cgi?id=1421366
[Bug 1421366] Review Request: MLib - Mandatory library for MediathekView
https://bugzilla.redhat.com/show_bug.cgi?id=1426243
[Bug 1426243] Review Request: MediathekView - Searches the online media library
https://bugzilla.redhat.com/show_bug.cgi?id=1467716
[Bug 1467716] Review Request: reactfx - Reactive event streams for JavaFX
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=652183
2 years, 7 months