[Bug 2134301] New: CVE-2022-40153 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks [epel-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2134301
Bug ID: 2134301
Summary: CVE-2022-40153 xstream: Xstream to serialise XML data
was vulnerable to Denial of Service attacks [epel-all]
Product: Fedora EPEL
Version: epel8
Status: NEW
Component: xstream
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: fedoraproject.org(a)bluhm-de.com
Reporter: pdelbell(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: didiksupriadi41(a)gmail.com,
fedoraproject.org(a)bluhm-de.com,
java-sig-commits(a)lists.fedoraproject.org,
lkundrak(a)v3.sk, mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora EPEL. While
only one tracking bug has been filed, please correct all affected versions
at the same time. If you need to fix the versions independent of each
other, you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2134301
10 months, 2 weeks
[Bug 2134303] New: CVE-2022-40152 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks [epel-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2134303
Bug ID: 2134303
Summary: CVE-2022-40152 xstream: Xstream to serialise XML data
was vulnerable to Denial of Service attacks [epel-all]
Product: Fedora EPEL
Version: epel8
Status: NEW
Component: xstream
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: fedoraproject.org(a)bluhm-de.com
Reporter: pdelbell(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: didiksupriadi41(a)gmail.com,
fedoraproject.org(a)bluhm-de.com,
java-sig-commits(a)lists.fedoraproject.org,
lkundrak(a)v3.sk, mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora EPEL. While
only one tracking bug has been filed, please correct all affected versions
at the same time. If you need to fix the versions independent of each
other, you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2134303
10 months, 2 weeks
[Bug 2157647] New: CVE-2022-4132 tomcat: Memory leak [epel-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2157647
Bug ID: 2157647
Summary: CVE-2022-4132 tomcat: Memory leak [epel-all]
Product: Fedora EPEL
Version: epel8
Status: NEW
Component: tomcat
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: csutherl(a)redhat.com
Reporter: pdelbell(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, csutherl(a)redhat.com,
gzaronikas(a)gmail.com, huwang(a)redhat.com,
ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2147372
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2157647
10 months, 2 weeks
[Bug 2141333] New: CVE-2022-42252 tomcat: request smuggling [epel-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2141333
Bug ID: 2141333
Summary: CVE-2022-42252 tomcat: request smuggling [epel-all]
Product: Fedora EPEL
Version: epel8
Status: NEW
Component: tomcat
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: csutherl(a)redhat.com
Reporter: pdelbell(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, gzaronikas(a)gmail.com,
huwang(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2141329
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2141333
10 months, 2 weeks
[Bug 2130599] New: CVE-2021-43980: Apache Tomcat: Information disclosure
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2130599
Bug ID: 2130599
Summary: CVE-2021-43980: Apache Tomcat: Information disclosure
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amctagga(a)redhat.com
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, gzaronikas(a)gmail.com,
huwang(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Other
Severity: important
Description:
The simplified implementation of blocking reads and writes introduced in
Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long
standing (but extremely hard to trigger) concurrency bug in Apache
Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60
and 8.5.0 to 8.5.77 that could cause client connections to share an
Http11Processor instance resulting in responses, or part responses, to
be received by the wrong client.
Credit:
Thanks to Adam Thomas, Richard Hernandez and Ryan Schmitt for
discovering the issue and working with the Tomcat security team to
identify the root cause and appropriate fix.
References:
https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2130599
10 months, 2 weeks
[Bug 2133649] New: CVE-2021-43980 tomcat: : Apache Tomcat: Information disclosure [epel-all]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2133649
Bug ID: 2133649
Summary: CVE-2021-43980 tomcat: : Apache Tomcat: Information
disclosure [epel-all]
Product: Fedora EPEL
Version: epel8
Status: NEW
Component: tomcat
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: csutherl(a)redhat.com
Reporter: trathi(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, coolsvap(a)gmail.com,
csutherl(a)redhat.com, gzaronikas(a)gmail.com,
huwang(a)redhat.com, ivan.afonichev(a)gmail.com,
java-sig-commits(a)lists.fedoraproject.org,
krzysztof.daniel(a)gmail.com
Target Milestone: ---
Classification: Fedora
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora EPEL. While
only one tracking bug has been filed, please correct all affected versions
at the same time. If you need to fix the versions independent of each
other, you may clone this bug as appropriate.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2133649
10 months, 2 weeks
[Bug 2051184] New: lancer fails to build with java-17-openjdk
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2051184
Bug ID: 2051184
Summary: lancer fails to build with java-17-openjdk
Product: Fedora
Version: rawhide
Status: NEW
Component: lancer
Severity: high
Assignee: willb(a)redhat.com
Reporter: jvanek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: didiksupriadi41(a)gmail.com,
java-maint-sig(a)lists.fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
jhuttana(a)redhat.com, jvanek(a)redhat.com,
pmikova(a)redhat.com, sgehwolf(a)redhat.com,
willb(a)redhat.com
Blocks: 2024265
Target Milestone: ---
Classification: Fedora
lancer fails to build with java-17-openjdk as sytem JDK. See
https://fedoraproject.org/wiki/Changes/Java17 .
See especially part about known failures:
https://fedoraproject.org/wiki/Changes/Java17#common_issues_packagers_can...
For the build logs, see:
https://koji.fedoraproject.org/koji/taskinfo?taskID=82430359
https://kojipkgs.fedoraproject.org/work/tasks/374/82430374/mock_output.log
https://kojipkgs.fedoraproject.org/work/tasks/374/82430374/hw_info.log
https://kojipkgs.fedoraproject.org/work/tasks/374/82430374/state.log
https://kojipkgs.fedoraproject.org/work/tasks/374/82430374/build.log
https://kojipkgs.fedoraproject.org/work/tasks/374/82430374/root.log
We run the rebuild in side tag f36-java17, but as fail ratio was small, we
expect this side tag to be merged into rawhide 7 or 8 of February 2022.
To reproduce before this date simply: fedpkg clone lancer; cd lancer; fedpkg
build --target f36-java17; #The target is crucial.
After this date the usual fedpkg build in f36 and up should do.
We run two reruns your package failed both.
We had also run the mass rebuilds in copr since November. We keep all
encountered failures. See them here:
https://copr.fedorainfracloud.org/coprs/jvanek/java17//package/lancer
You may find interesting additional informations here. Also we were spamming
maintainers regualrly, check you spam folder.
We had tried aprox 500 packages, and aprox 65 had failed, so the
java-17-openjdk will be system JDK in f36, and you should fix your package if
you want to keep it alive. Usually the fix is simple, and best is to update the
package to latest upstream version.
There will be usual mass rebuild once f36 branches. You may got another FTBFS
bug.
Let us know here if you have any questions, here in bug, or at
java-devel(a)lists.fedoraproject.org .
We'd appreciate help from the people who know this package best, but if you
don't want to work on this now, let us know so we can try to work around it on
our side if needed.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2024265
[Bug 2024265] java-17-openjdk as system JDK in F36
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2051184
11 months
[Bug 2130376] New: Apache httpcomponents-client package is missing httpmime.jar
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2130376
Bug ID: 2130376
Summary: Apache httpcomponents-client package is missing
httpmime.jar
Product: Fedora
Version: 36
Status: NEW
Component: httpcomponents-client
Assignee: stuart(a)gathman.org
Reporter: sima85307(a)mypacks.net
QA Contact: extras-qa(a)fedoraproject.org
CC: java-sig-commits(a)lists.fedoraproject.org,
jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com,
mizdebsk(a)redhat.com, stuart(a)gathman.org
Target Milestone: ---
Classification: Fedora
Description of problem:
The httpmime.jar build artifact is missing from the Apache
httpcomponents-client package.
Version-Release number of selected component (if applicable):
If I recall correctly, this file went missing in the transition from Fedora 34
to 35. It is missing in all versions 35 onward.
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2130376
11 months
[Bug 2098100] New: ant-contrib, one of important components of aqa java certification gone form fedora
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2098100
Bug ID: 2098100
Summary: ant-contrib, one of important components of aqa java
certification gone form fedora
Product: Fedora
Version: 36
Status: NEW
Component: ant-contrib
Assignee: extras-orphan(a)fedoraproject.org
Reporter: jvanek(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: akurtako(a)redhat.com, extras-orphan(a)fedoraproject.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
To support java certifications - namely Adoptium aqavid - and thus java build
toolchain, and thus java-stack health in Fedora, ant-contirb is an crucial part
of fedora javabuild toolchain.
Without ant-contrib, vendors of openjdk will need to select different
enviroenmet to pass aqa certification,m which wil be another death blow to
dying javastack.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2098100
11 months