[Bug 1922569] New: plexus-archiver-4.2.4 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1922569
Bug ID: 1922569
Summary: plexus-archiver-4.2.4 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: plexus-archiver
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, decathorpe(a)gmail.com,
jaromir.capik(a)email.cz,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 4.2.4
Current version/release in rawhide: 4.2.3-1.fc34
URL: http://codehaus-plexus.github.io/plexus-archiver
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/3655/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month
[Bug 1922575] New: maven-common-artifact-filters-3.1.1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1922575
Bug ID: 1922575
Summary: maven-common-artifact-filters-3.1.1 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: maven-common-artifact-filters
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, puntogil(a)libero.it
Target Milestone: ---
Classification: Fedora
Latest upstream release: 3.1.1
Current version/release in rawhide: 3.1.0-3.fc33
URL: http://maven.apache.org/shared/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/12374/
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month
[Bug 1923838] CVE-2020-17523 shiro: Authentication bypass through specially crafted HTTP request
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1923838
--- Comment #3 from Ted (Jong Seok) Won <jwon(a)redhat.com> ---
Marking Red Hat Fuse 7 as having a low impact, Fuse 7 distributes some shiro
artifacts (shiro-core) as part of camel-shiro however these artifacts are not
impacted by the vulnerability.
Marking Red Hat JBoss Fuse 6 as having a moderate impact, Fuse 6 does
distribute some shiro artifacts as part of camel-shiro, however these are not
affected by the vulnerability, only components using shiro in the context of
the web application portion of the shiro framework are affected and only the
artifacts org.apache.shiro:shiro-web:*, org.apache.shiro:shiro-spring:*,
org.apache.shiro:shiro-guice:* and org.apache.shiro:shiro-all:* are altered in
the fix version of shiro (1.6.0)
Red Hat JBoss AMQ-6 does however distribute shiro-spring in error as part of
the activemq shiro plugin, the artifact would not be used under normal
circumstances and the issue has been marked as moderate because of this,
however as a precaution we have requested the superfluous shiro-spring artifact
be removed from any deliverables.
This vulnerability is out of security support scope for the following
products:
* Red Hat JBoss Fuse 6
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes
for more details.
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month
[Bug 1916633] CVE-2021-20190 jackson-databind: mishandles the interaction between serialization gadgets and typing, related to javax.swing
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1916633
--- Comment #15 from Todd Cullum <tcullum(a)redhat.com> ---
Statement:
The following Red Hat products do ship the vulnerable component, but do not
enable the unsafe conditions needed to exploit, lowering their vulnerability
impact:
* JBoss Data Grid 7
* Business Process Management Suite 6
* Business Rules Management Suite 6
* JBoss Data Virtualization 6
* Red Hat Fuse Service Works 6
* Red Hat OpenStack Platform
* Red Hat OpenShift containers: ose-metering-hadoop, ose-metering-hive,
ose-logging-elasticsearch5, ose-logging-elasticsearch6
These products may update the jackson-databind dependency in a future release.
In Red Hat Openshift 4 there are no plans to maintain the
ose-logging-elasticsearch5 container, therefore it has been marked wontfix at
this time and may be fixed in a future update.
The following Red Hat products ship OpenDaylight, which contains the vulnerable
jackson-databind, but do not expose jackson-databind in a way that would make
it exploitable:
* Red Hat OpenStack Platform 13
As such, Red Hat will not be providing a fix for OpenDaylight at this time.
The following Red Hat products are not affected by this flaw because they use a
more recent version of jackson-databind that does not contain the vulnerable
code:
* CodeReady Studio 12.16.0
* CodeReady WorkSpaces Server Container
* Red Hat Enterprise Linux 8
* Red Hat Enterprise Virtualization
* Red Hat Satellite 6
* Red Hat OpenShift container: ose-metering-presto
--
You are receiving this mail because:
You are on the CC list for the bug.
2 years, 1 month