[Bug 2019329] New: nosync.so is linked against GLIBC_2.34 symbols, it breaks mock
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2019329
Bug ID: 2019329
Summary: nosync.so is linked against GLIBC_2.34 symbols, it
breaks mock
Product: Fedora
Version: 35
Status: NEW
Component: nosync
Assignee: mizdebsk(a)redhat.com
Reporter: praiskup(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
I'm not sure what changed, but the new dependency is breaking
Mock builds for older distributions (e.g. even Fedora 34 doesn't
provide 2.34 symbols).
$ cat ~/.config/mock.cfg | grep nosync
config_opts['nosync'] = True
$ mock -r fedora-34-x86_64 --shell
...
Running scriptlet: ca-certificates-2021.2.50-1.0.fc34.noarch
83/134
/bin/sh: /lib64/libc.so.6: version `GLIBC_2.34' not found (required by
/var/tmp/tmp.mock.khvcffv5/lib64/nosync.so)
error: %prein(ca-certificates-2021.2.50-1.0.fc34.noarch) scriptlet failed, exit
status 1
Error in PREIN scriptlet in rpm package ca-certificates
Installing : krb5-libs-1.19.2-2.fc34.x86_64
84/134
error: ca-certificates-2021.2.50-1.0.fc34.noarch: install failed
...
Failed:
ca-certificates-2021.2.50-1.0.fc34.noarch
tpm2-tss-3.1.0-1.fc34.x86_64
Error: Transaction failed
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2019329
4 months
[Bug 1955739] New: CVE-2021-26291 maven: Block repositories using http by default
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1955739
Bug ID: 1955739
Summary: CVE-2021-26291 maven: Block repositories using http by
default
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aboyko(a)redhat.com, aileenc(a)redhat.com,
akoufoud(a)redhat.com, alazarot(a)redhat.com,
almorale(a)redhat.com, anstephe(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
bbaranow(a)redhat.com, bmaxwell(a)redhat.com,
brian.stansberry(a)redhat.com, cdewolf(a)redhat.com,
chazlett(a)redhat.com, darran.lofthouse(a)redhat.com,
dkreling(a)redhat.com, dosoudil(a)redhat.com,
eleandro(a)redhat.com, etirelli(a)redhat.com,
fjuma(a)redhat.com, gvarsami(a)redhat.com,
ibek(a)redhat.com, iweiss(a)redhat.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jcoleman(a)redhat.com, jochrist(a)redhat.com,
jperkins(a)redhat.com, jstastny(a)redhat.com,
jwon(a)redhat.com, kaycoth(a)redhat.com,
kconner(a)redhat.com, krathod(a)redhat.com,
kverlaen(a)redhat.com, kwills(a)redhat.com,
ldimaggi(a)redhat.com, lgao(a)redhat.com,
mizdebsk(a)redhat.com, mnovotny(a)redhat.com,
msochure(a)redhat.com, msrb(a)redhat.com,
msvehla(a)redhat.com, nwallace(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
rwagner(a)redhat.com, smaestri(a)redhat.com,
sochotni(a)redhat.com, tcunning(a)redhat.com,
tkirby(a)redhat.com, tom.jenkinson(a)redhat.com,
tzimanyi(a)redhat.com, yborgess(a)redhat.com
Target Milestone: ---
Classification: Other
Apache Maven will follow repositories that are defined in a dependency’s
Project Object Model (pom) which may be surprising to some users, resulting in
potential risk if a malicious actor takes over that repository or is able to
insert themselves into a position to pretend to be that repository. Maven is
changing the default behavior in 3.8.1+ to no longer follow http (non-SSL)
repository references by default. If you are currently using a repository
manager to govern the repositories used by your builds, you are unaffected by
the risks present in the legacy behavior, and are unaffected by this
vulnerability and change to default behavior.
References:
https://lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099...
https://lists.apache.org/thread.html/r06db4057b74e0598a412734f693a34a8836...
https://lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099...
http://www.openwall.com/lists/oss-security/2021/04/23/5
https://lists.apache.org/thread.html/r0556ce5db7231025785477739ee416b169d...
https://lists.apache.org/thread.html/ra88a0eba7f84658cefcecc0143fd8bbad52...
https://lists.apache.org/thread.html/r3f0450dcab7e63b5f233ccfbc6fca5f1867...
--
You are receiving this mail because:
You are on the CC list for the bug.
4 months, 1 week
[Bug 1892123] New: google-guice-5.0.0-BETA-1 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1892123
Bug ID: 1892123
Summary: google-guice-5.0.0-BETA-1 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: google-guice
Keywords: FutureFeature, Triaged
Assignee: java-maint-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: decathorpe(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, sochotni(a)redhat.com
Target Milestone: ---
Classification: Fedora
Latest upstream release: 5.0.0-BETA-1
Current version/release in rawhide: 4.2.3-3.fc33
URL: https://github.com/google/guice
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1231/
--
You are receiving this mail because:
You are on the CC list for the bug.
4 months, 2 weeks
[Bug 2055480] New: CVE-2021-22060 springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096)
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2055480
Bug ID: 2055480
Summary: CVE-2021-22060 springframework: Additional Log
Injection in Spring Framework (follow-up to
CVE-2021-22096)
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: jwon(a)redhat.com
CC: aboyko(a)redhat.com, ahenning(a)redhat.com,
aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, chazlett(a)redhat.com,
dchen(a)redhat.com, drieden(a)redhat.com,
emingora(a)redhat.com, etirelli(a)redhat.com,
extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com,
gmalinko(a)redhat.com, ibek(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jochrist(a)redhat.com, jolee(a)redhat.com,
jrokos(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
lsurette(a)redhat.com, michal.skrivanek(a)redhat.com,
mnovotny(a)redhat.com, mperina(a)redhat.com,
pdelbell(a)redhat.com, pjindal(a)redhat.com,
pskopek(a)redhat.com, puntogil(a)libero.it,
rguimara(a)redhat.com, rrajasek(a)redhat.com,
sbonazzo(a)redhat.com, sguilhen(a)redhat.com,
tzimanyi(a)redhat.com
Blocks: 2044407
Target Milestone: ---
Classification: Other
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older
unsupported versions, it is possible for a user to provide malicious input to
cause the insertion of additional log entries. This is a follow-up to
CVE-2021-22096 that protects against additional types of input and in more
places of the Spring Framework codebase.
https://nvd.nist.gov/vuln/detail/CVE-2021-22060
https://tanzu.vmware.com/security/cve-2021-22060
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2055480
5 months, 3 weeks
[Bug 2034584] New: CVE-2021-22096 springframework: malicious input leads to insertion of additional log entries
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2034584
Bug ID: 2034584
Summary: CVE-2021-22096 springframework: malicious input leads
to insertion of additional log entries
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: darunesh(a)redhat.com
CC: aboyko(a)redhat.com, ahenning(a)redhat.com,
aileenc(a)redhat.com, akoufoud(a)redhat.com,
alazarot(a)redhat.com, almorale(a)redhat.com,
anstephe(a)redhat.com, chazlett(a)redhat.com,
dchen(a)redhat.com, drieden(a)redhat.com,
etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
hvyas(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jochrist(a)redhat.com, jolee(a)redhat.com,
jrokos(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
lef(a)fedoraproject.org, lsurette(a)redhat.com,
michal.skrivanek(a)redhat.com, mnovotny(a)redhat.com,
mperina(a)redhat.com, pdelbell(a)redhat.com,
pjindal(a)redhat.com, pskopek(a)redhat.com,
puntogil(a)libero.it, rrajasek(a)redhat.com,
sbonazzo(a)redhat.com, sguilhen(a)redhat.com,
tzimanyi(a)redhat.com
Target Milestone: ---
Classification: Other
In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older
unsupported versions, it is possible for a user to provide malicious input to
cause the insertion of additional log entries.
References:
https://tanzu.vmware.com/security/cve-2021-22096
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2034584
5 months, 3 weeks
[Bug 1819818] New: Please package fop for epel-8
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1819818
Bug ID: 1819818
Summary: Please package fop for epel-8
Product: Fedora EPEL
Version: epel8
Hardware: All
OS: Linux
Status: NEW
Component: fop
Severity: medium
Assignee: rlandman(a)redhat.com
Reporter: TicoTimo(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: c.david86(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, rhbugs(a)n-dimensional.de,
rlandman(a)redhat.com, tim(a)tim-landscheidt.de
Target Milestone: ---
Classification: Fedora
fop was available in CentOS-7:
http://mirror.centos.org/centos/7/os/x86_64/Packages/fop-1.1-6.el7.noarch...
It is still available Fedora.
This is the one package missing from claiming full support for CentOS-8 for
Yocto Project (documentation build depends on fop).
NOTE: I am willing to work on this as a co-maintainer. fas: ttorling
-------------
Naively cloning f30 branch and performing a local build (on CentOS-8)
(fop-2.2):
ant is available as module
error: Failed build dependencies:
apache-commons,
avalon-framework,
batik,
fontbox,
javapackages-local,
junit,
qdox,
servlet,
xmlgraphics-commons,
xmlunit
Similar for f32 branch (fop-2.4).
error: Failed build dependencies:
apache-commons-io
apache-commons-logging
batik
fontbox
javapackages-local
junit
qdox
servlet
xmlgraphics-commons
xmlunit
--
You are receiving this mail because:
You are on the CC list for the bug.
6 months
[Bug 2047343] New: CVE-2022-21363 mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2047343
Bug ID: 2047343
Summary: CVE-2022-21363 mysql-connector-java: Difficult to
exploit vulnerability allows high privileged attacker
with network access via multiple protocols to
compromise MySQL Connectors
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: aileenc(a)redhat.com, alazarot(a)redhat.com,
anstephe(a)redhat.com, aos-bugs(a)redhat.com,
asoldano(a)redhat.com, atangrin(a)redhat.com,
avibelli(a)redhat.com, bbaranow(a)redhat.com,
bbuckingham(a)redhat.com, bcourt(a)redhat.com,
bgeorges(a)redhat.com, bibryam(a)redhat.com,
bmaxwell(a)redhat.com, bmontgom(a)redhat.com,
brian.stansberry(a)redhat.com, btotty(a)redhat.com,
cdewolf(a)redhat.com, chazlett(a)redhat.com,
clement.escoffier(a)redhat.com, dandread(a)redhat.com,
darran.lofthouse(a)redhat.com,
databases-maint(a)redhat.com, dkreling(a)redhat.com,
dosoudil(a)redhat.com, drieden(a)redhat.com,
ehelms(a)redhat.com, eleandro(a)redhat.com,
emingora(a)redhat.com, eparis(a)redhat.com,
etirelli(a)redhat.com, fjuma(a)redhat.com,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
gmorling(a)redhat.com, gsmet(a)redhat.com,
hamadhan(a)redhat.com, hbraun(a)redhat.com,
hhorak(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jburrell(a)redhat.com, jjanco(a)redhat.com,
jnethert(a)redhat.com, jochrist(a)redhat.com,
jokerman(a)redhat.com, jolee(a)redhat.com,
jpallich(a)redhat.com, jpechane(a)redhat.com,
jperkins(a)redhat.com, jrokos(a)redhat.com,
jschatte(a)redhat.com, jsherril(a)redhat.com,
jstastny(a)redhat.com, jwon(a)redhat.com,
krathod(a)redhat.com, kverlaen(a)redhat.com,
kwills(a)redhat.com, lgao(a)redhat.com,
ljavorsk(a)redhat.com, lthon(a)redhat.com,
lzap(a)redhat.com, mhulan(a)redhat.com, mkulik(a)redhat.com,
mmccune(a)redhat.com, mmuzila(a)redhat.com,
mnovotny(a)redhat.com, mschorm(a)redhat.com,
msochure(a)redhat.com, msvehla(a)redhat.com,
mszynkie(a)redhat.com, myarboro(a)redhat.com,
nmoumoul(a)redhat.com, nstielau(a)redhat.com,
nwallace(a)redhat.com, odubaj(a)redhat.com,
orabin(a)redhat.com, pantinor(a)redhat.com,
pcreech(a)redhat.com, pdelbell(a)redhat.com,
peholase(a)redhat.com, pgallagh(a)redhat.com,
pjindal(a)redhat.com, pmackay(a)redhat.com,
probinso(a)redhat.com, puntogil(a)libero.it,
rchan(a)redhat.com, rguimara(a)redhat.com,
rrajasek(a)redhat.com, rruss(a)redhat.com,
rstancel(a)redhat.com, rsvoboda(a)redhat.com,
sbiarozk(a)redhat.com, sd-operator-metering(a)redhat.com,
sdouglas(a)redhat.com, smaestri(a)redhat.com,
sponnaga(a)redhat.com, steve.traylen(a)cern.ch,
tflannag(a)redhat.com, tom.jenkinson(a)redhat.com,
tzimanyi(a)redhat.com, xjakub(a)fi.muni.cz,
yborgess(a)redhat.com, zmiklank(a)redhat.com
Target Milestone: ---
Classification: Other
Vulnerability in the MySQL Connectors product of Oracle MySQL (component:
Connector/J). Supported versions that are affected are 8.0.27 and prior.
Difficult to exploit vulnerability allows high privileged attacker with network
access via multiple protocols to compromise MySQL Connectors. Successful
attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS
3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS
Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Reference:
https://www.oracle.com/security-alerts/cpujan2022.html
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2047343
6 months, 2 weeks
[Bug 1807472] New: jflex-1.8.0 is available
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1807472
Bug ID: 1807472
Summary: jflex-1.8.0 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: jflex
Keywords: FutureFeature, Triaged
Assignee: stewardship-sig(a)lists.fedoraproject.org
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, decathorpe(a)gmail.com,
jaromir.capik(a)email.cz,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com,
stewardship-sig(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest upstream release: 1.8.0
Current version/release in rawhide: 1.7.0-2.fc32
URL: http://jflex.de/download.html
Please consult the package updates policy before you issue an update to a
stable branch: https://fedoraproject.org/wiki/Updates_Policy
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from anitya:
https://release-monitoring.org/project/1449/
--
You are receiving this mail because:
You are on the CC list for the bug.
6 months, 2 weeks