[Bug 1652662] jenkins-credentials-plugin-2.2.0 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1652662
Michal Srb <msrb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
Last Closed| |2021-02-24 11:58:07
--- Comment #3 from Michal Srb <msrb(a)redhat.com> ---
Jenkins package is no longer shipped in any of the supported Fedora releases.
Therefore closing...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1382979] jenkins-ant-plugin-1.8 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1382979
Michal Srb <msrb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
Last Closed| |2021-02-24 11:57:58
--- Comment #5 from Michal Srb <msrb(a)redhat.com> ---
Jenkins package is no longer shipped in any of the supported Fedora releases.
Therefore closing...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1346528] jenkins-remoting-3.33 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1346528
Michal Srb <msrb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
Last Closed| |2021-02-24 11:57:49
--- Comment #31 from Michal Srb <msrb(a)redhat.com> ---
Jenkins package is no longer shipped in any of the supported Fedora releases.
Therefore closing...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1340302] owasp-java-html-sanitizer-20190610.1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1340302
Michal Srb <msrb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
Last Closed| |2021-02-24 11:57:32
--- Comment #15 from Michal Srb <msrb(a)redhat.com> ---
Jenkins package is no longer shipped in any of the supported Fedora releases.
Therefore closing...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1332034] jenkins-junit-plugin-1.28 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1332034
Michal Srb <msrb(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |CLOSED
Resolution|--- |WONTFIX
Last Closed| |2021-02-24 11:57:14
--- Comment #13 from Michal Srb <msrb(a)redhat.com> ---
Jenkins package is no longer shipped in any of the supported Fedora releases.
Therefore closing...
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month
[Bug 1887664] CVE-2020-25649 jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1887664
--- Comment #62 from Jonathan Christison <jochrist(a)redhat.com> ---
Further to comment#33 and marking Red Hat Fuse 7 and Red Hat Integration Camel
K as having a moderate impact we believe a low impact is more appropriate and
better represents Red Hat's specification of a low impact flaw -
https://access.redhat.com/security/updates/classification
Which describes low impact vulnerabilities as "These are the types of
vulnerabilities that are believed to require unlikely circumstances to be able
to be exploited".
In the case of jackson-databind `DomDeserializer` actually being called it we
believe those unlikely circumstances to be
*) Camel components making use of jackson-databind do not expose this
functionality
*) There are specialised components in camel to parse and deserialize DOM such
as camel-jacksonxml which relies on jackson-dataformat-xml,
jackson-dataformat-xml is not vulnerable to this XXE flaw
*) We believe the usage pattern is itself unlikely and can find no further
evidence of implicit use
```java
ObjectMapper mapper = new ObjectMapper();
Document doc = mapper.readValue("\"<badxml/>\"", Document.class);
```
--
You are receiving this mail because:
You are on the CC list for the bug.
3 years, 1 month