[Bug 1923838] CVE-2020-17523 shiro: Authentication bypass through specially crafted HTTP request
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1923838
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment|3 |updated
--- Comment #3 has been edited ---
Marking Red Hat Fuse 7 as having a low impact, Fuse 7 distributes some shiro
artifacts (shiro-core) as part of camel-shiro however these artifacts are not
impacted by the vulnerability.
Marking Red Hat JBoss Fuse 6 as having a moderate impact, Fuse 6 does
distribute some shiro artifacts as part of camel-shiro, however these are not
affected by the vulnerability, only components using shiro in the context of
the spring web application portion of the shiro framework are affected and only
the artifact org.apache.shiro:spring-boot-web-starter is altered in the fix
version of shiro (1.7.1)
This vulnerability is out of security support scope for the following
products:
* Red Hat JBoss Fuse 6
* Red Hat JBoss A-MQ 6
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes
for more details.
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month
[Bug 1902189] New: jctools-3.2.0 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1902189
Bug ID: 1902189
Summary: jctools-3.2.0 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: jctools
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it, roman(a)fenkhuber.at
Target Milestone: ---
Classification: Fedora
Latest upstream release: 3.2.0
Current version/release in rawhide: 3.1.0-1.fc34
URL: https://github.com/JCTools/JCTools
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/89333/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month
[Bug 1902426] New: maven-wagon-3.4.2 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1902426
Bug ID: 1902426
Summary: maven-wagon-3.4.2 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: maven-wagon
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, decathorpe(a)gmail.com,
fnasser(a)redhat.com, jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, yyang(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 3.4.2
Current version/release in rawhide: 3.4.1-3.fc33
URL: http://maven.apache.org/wagon
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1947/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month
[Bug 1902202] New: felix-utils-1.11.6 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1902202
Bug ID: 1902202
Summary: felix-utils-1.11.6 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: felix-utils
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com, jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 1.11.6
Current version/release in rawhide: 1.11.4-3.fc33
URL: http://www.apache.org/dist/felix/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/799/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month
[Bug 1910676] New: mojo-parent-60 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1910676
Bug ID: 1910676
Summary: mojo-parent-60 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: mojo-parent
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, sochotni(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 60
Current version/release in rawhide: 50-3.fc33
URL: http://www.mojohaus.org/mojo-parent/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/2005/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month
[Bug 1910186] New: plexus-pom-7 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1910186
Bug ID: 1910186
Summary: plexus-pom-7 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: plexus-pom
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
Latest upstream release: 7
Current version/release in rawhide: 6.5-1.fc34
URL: https://github.com/codehaus-plexus/plexus-pom
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/20412/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month
[Bug 1921054] New: weld-parent-44 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1921054
Bug ID: 1921054
Summary: weld-parent-44 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: weld-parent
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
Latest upstream release: 44
Current version/release in rawhide: 42-1.fc34
URL: http://weld.cdi-spec.org
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/20402/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month