December 2023 - java-sig-commits - Fedora mailing-lists

[Bug 1719748] New: jetty-9.4.19.v20190610 is available
by bugzilla＠redhat.com 23 Dec '24

23 Dec '24

https://bugzilla.redhat.com/show_bug.cgi?id=1719748 Bug ID: 1719748 Summary: jetty-9.4.19.v20190610 is available Product: Fedora Version: rawhide Status: NEW Component: jetty Keywords: FutureFeature, Triaged Assignee: mat.booth(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jjohnstn(a)redhat.com, krzysztof.daniel(a)gmail.com, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, sochotni(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 9.4.19.v20190610 Current version/release in rawhide: 9.4.18-2.v20190429.fc31 URL: http://www.eclipse.org/jetty Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1447/ -- You are receiving this mail because: You are on the CC list for the bug.

1 48

[Bug 2137095] New: plexus-utils-3.5.0 is available
by bugzilla＠redhat.com 15 Dec '24

15 Dec '24

https://bugzilla.redhat.com/show_bug.cgi?id=2137095 Bug ID: 2137095 Summary: plexus-utils-3.5.0 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-utils Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: fnasser(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.5.0 Upstream release that is considered latest: 3.5.0 Current version/release in rawhide: 3.4.2-1.fc38 URL: https://codehaus-plexus.github.io/plexus-utils/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/6072/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/plexus-utils -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2137095

1 5

[Bug 2103340] New: log4j-2.18.0 is available
by bugzilla＠redhat.com 13 Dec '24

13 Dec '24

https://bugzilla.redhat.com/show_bug.cgi?id=2103340 Bug ID: 2103340 Summary: log4j-2.18.0 is available Product: Fedora Version: rawhide Status: NEW Component: log4j Keywords: FutureFeature, Triaged Assignee: paul.wouters(a)aiven.io Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, devrim(a)gunduz.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io Target Milestone: --- Classification: Fedora Releases retrieved: 2.18.0 Upstream release that is considered latest: 2.18.0 Current version/release in rawhide: 2.17.2-2.fc37 URL: http://www.apache.org/dist/logging/log4j Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1836/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/log4j -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2103340

1 34

[Bug 2091428] New: maven-invoker-plugin-3.3.0 is available
by bugzilla＠redhat.com 09 Dec '24

09 Dec '24

https://bugzilla.redhat.com/show_bug.cgi?id=2091428 Bug ID: 2091428 Summary: maven-invoker-plugin-3.3.0 is available Product: Fedora Version: rawhide Status: NEW Component: maven-invoker-plugin Keywords: FutureFeature, Triaged Assignee: markku.korkeala(a)kapsi.fi Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, markku.korkeala(a)kapsi.fi, mizdebsk(a)redhat.com, weli(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 3.3.0 Current version/release in rawhide: 3.2.2-2.fc37 URL: http://maven.apache.org/plugins/maven-invoker-plugin/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1916/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2091428

1 9

[Bug 2058212] New: stack-overflow in do_ea in disasm.c:377, ndisasm in the latest version of nasm
by bugzilla＠redhat.com 09 Dec '24

09 Dec '24

https://bugzilla.redhat.com/show_bug.cgi?id=2058212 Bug ID: 2058212 Summary: stack-overflow in do_ea in disasm.c:377, ndisasm in the latest version of nasm Product: Fedora Version: 36 Status: NEW Component: nasm Assignee: dominik(a)greysector.net Reporter: zhengh(a)nipc.org.cn QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora Created attachment 1863189 --> https://bugzilla.redhat.com/attachment.cgi?id=1863189&action=edit poc Description of problem: nasm's disasm has a stack-overflow in disasm.c:377 function do_ea. Version-Release number of selected component (if applicable): latest commit 3f9fc2a3a7134936cbbae5780beb4319694f702a How reproducible: export CFLAGS="-fsanitize=address -g" export CC=clang ./autogen.sh ./configure --disable-shared make -j8 ./ndisasm ./stack_overflow.1 ==1251159==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd083b8240 at pc 0x0000004d51e6 bp 0x7ffd083b5d60 sp 0x7ffd083b5d58 READ of size 1 at 0x7ffd083b8240 thread T0 #0 0x4d51e5 in do_ea /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:377:38 #1 0x4cf302 in matches /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:675:20 #2 0x4ca0a0 in disasm /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:1345:23 #3 0x4c471b in main /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/ndisasm.c:323:22 #4 0x7f9603c7efcf in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #5 0x7f9603c7f07c in __libc_start_main csu/../csu/libc-start.c:409:3 #6 0x41c2d4 in _start (/home/kdsj/workspace/benchmarks/reproduce/nasm/ndisasm+0x41c2d4) Address 0x7ffd083b8240 is located in stack of thread T0 at offset 96 in frame #0 0x4c278f in main /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/ndisasm.c:84 This frame has 6 object(s): [32, 96) 'buffer' (line 85) <== Memory access at offset 96 overflows this variable [128, 136) 'ep' (line 85) [160, 416) 'outbuf' (line 86) [480, 484) 'synclen' (line 89) [496, 516) 'prefer' (line 95) [560, 561) 'rn_error' (line 96) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow /home/kdsj/workspace/benchmarks/reproduce/nasm/disasm/disasm.c:377:38 in do_ea Shadow bytes around the buggy address: 0x10002106eff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f030: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 =>0x10002106f040: 00 00 00 00 00 00 00 00[f2]f2 f2 f2 00 f2 f2 f2 0x10002106f050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f070: f2 f2 f2 f2 f2 f2 f2 f2 04 f2 00 00 04 f2 f2 f2 0x10002106f080: f2 f2 01 f3 00 00 00 00 00 00 00 00 00 00 00 00 0x10002106f090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Additional info: This bug is reported by nipc(http://www.nipc.org.cn/). -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2058212

1 4

[Bug 2226490] New: truth: FTBFS in Fedora rawhide/f39
by bugzilla＠redhat.com 27 Nov '24

27 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2226490 Bug ID: 2226490 Summary: truth: FTBFS in Fedora rawhide/f39 Product: Fedora Version: rawhide Status: NEW Component: truth Assignee: orion(a)nwra.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, orion(a)nwra.com Blocks: 2168842 (F39FTBFS,RAWHIDEFTBFS) Target Milestone: --- Classification: Fedora truth failed to build from source in Fedora rawhide/f39 https://koji.fedoraproject.org/koji/taskinfo?taskID=103748545 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Please fix truth at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, truth will be orphaned. Before branching of Fedora 40, truth will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails… Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2168842 [Bug 2168842] Fedora 39 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2226490 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 5

[Bug 2225914] New: hawtjni: FTBFS in Fedora rawhide/f39
by bugzilla＠redhat.com 27 Nov '24

27 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2225914 Bug ID: 2225914 Summary: hawtjni: FTBFS in Fedora rawhide/f39 Product: Fedora Version: rawhide Status: NEW Component: hawtjni Assignee: extras-orphan(a)fedoraproject.org Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, puntogil(a)libero.it Blocks: 2168842 (F39FTBFS,RAWHIDEFTBFS) Target Milestone: --- Classification: Fedora hawtjni failed to build from source in Fedora rawhide/f39 https://koji.fedoraproject.org/koji/taskinfo?taskID=103606947 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Please fix hawtjni at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, hawtjni will be orphaned. Before branching of Fedora 40, hawtjni will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails… Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2168842 [Bug 2168842] Fedora 39 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2225914 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 8

[Bug 2222114] New: nasm: Update spec License entry to use SPDX identifiers
by bugzilla＠redhat.com 27 Nov '24

27 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2222114 Bug ID: 2222114 Summary: nasm: Update spec License entry to use SPDX identifiers Product: Fedora Version: rawhide OS: Linux Status: NEW Component: nasm Severity: medium Assignee: dominik(a)greysector.net Reporter: mpolacek(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora Update spec License entry to use SPDX identifiers. Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2222114 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2149756] New: aqute-bnd-6.4.0 is available
by bugzilla＠redhat.com 27 Nov '24

27 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2149756 Bug ID: 2149756 Summary: aqute-bnd-6.4.0 is available Product: Fedora Version: rawhide Status: NEW Component: aqute-bnd Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 6.4.0 Upstream release that is considered latest: 6.4.0 Current version/release in rawhide: 6.3.1-2.fc38 URL: http://bnd.bndtools.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/98/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/aqute-bnd -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2149756

1 4

[Bug 2031667] New: log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender
by bugzilla＠redhat.com 24 Nov '24

24 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2031667 Bug ID: 2031667 Summary: log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: pjindal(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, aos-bugs(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bdettelb(a)redhat.com, bgeorges(a)redhat.com, bibryam(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, boliveir(a)redhat.com, brian.stansberry(a)redhat.com, caswilli(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, clement.escoffier(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dbecker(a)redhat.com, dbhole(a)redhat.com, devrim(a)gunduz.org, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eleandro(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ewolinet(a)redhat.com, fjuma(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gsmet(a)redhat.com, hamadhan(a)redhat.com, hbraun(a)redhat.com, hhorak(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jcantril(a)redhat.com, jjoyce(a)redhat.com, jnethert(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jrokos(a)redhat.com, jross(a)redhat.com, jschluet(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com, mburns(a)redhat.com, mizdebsk(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, pantinor(a)redhat.com, pdelbell(a)redhat.com, pdrozd(a)redhat.com, peholase(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, probinso(a)redhat.com, rguimara(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, sbiarozk(a)redhat.com, sclewis(a)redhat.com, sd-operator-metering(a)redhat.com, sdouglas(a)redhat.com, sergio(a)serjux.com, slinaber(a)redhat.com, smaestri(a)redhat.com, sponnaga(a)redhat.com, sthorger(a)redhat.com, swoodman(a)redhat.com, tflannag(a)redhat.com, tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com, vkumar(a)redhat.com, yborgess(a)redhat.com Blocks: 2030930 Target Milestone: --- Classification: Other A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender. In 1.x you will find that there are two places where lookups are done - that is JMSAppender.java:207 and JMSAppender.java:222 - if you set TopicBindingName or TopicConnectionFactoryBindingName to something that JNDI can handle - for example "ldap://host:port/a" JNDI will do exactly the same thing it does for 2.x - so 1.x is vulnerable, just attack vector is "safer" as it depends on configuration rather than user input -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2031667

1 136

[Bug 1796225] New: CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling
by bugzilla＠redhat.com 24 Nov '24

24 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=1796225 Bug ID: 1796225 Summary: CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dbecker(a)redhat.com, decathorpe(a)gmail.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, esammons(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, gvarsami(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcoleman(a)redhat.com, jerboaa(a)gmail.com, jjoyce(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jross(a)redhat.com, jschatte(a)redhat.com, jschluet(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kbasil(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com, loleary(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mburns(a)redhat.com, mcressma(a)redhat.com, mkolesni(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, rchan(a)redhat.com, rguimara(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sclewis(a)redhat.com, scohen(a)redhat.com, sdaley(a)redhat.com, slinaber(a)redhat.com, smaestri(a)redhat.com, sochotni(a)redhat.com, sokeeffe(a)redhat.com, spinder(a)redhat.com, sponnaga(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org, sthorger(a)redhat.com, swoodman(a)redhat.com, tbrisker(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com Target Milestone: --- Classification: Other Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869. References: https://github.com/jdordonezn/CVE-2020-72381/issues/1 https://netty.io/news/ -- You are receiving this mail because: You are on the CC list for the bug.

1 65

[Bug 1847573] New: Please provide antlr3 version for EPEL8
by bugzilla＠redhat.com 20 Nov '24

20 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=1847573 Bug ID: 1847573 Summary: Please provide antlr3 version for EPEL8 Product: Fedora EPEL Version: epel8 Status: NEW Component: antlr3 Assignee: dingyichen(a)gmail.com Reporter: minfrin(a)sharp.fm QA Contact: extras-qa(a)fedoraproject.org CC: dingyichen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, loganjerry(a)gmail.com, mizdebsk(a)redhat.com, walters(a)redhat.com Target Milestone: --- Classification: Fedora Description of problem: Version not available for EPEL8. Version-Release number of selected component (if applicable): None. How reproducible: Always. Steps to Reproduce: 1. dnf install antlr3-C-devel Actual results: Error: Unable to find a match: antlr3-C-devel Expected results: Package installed. Additional info: -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 2134991] New: easymock-5.0.0 is available
by bugzilla＠redhat.com 17 Nov '24

17 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2134991 Bug ID: 2134991 Summary: easymock-5.0.0 is available Product: Fedora Version: rawhide Status: NEW Component: easymock Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, fnasser(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 5.0.0 Upstream release that is considered latest: 5.0.0 Current version/release in rawhide: 4.3-1.fc38 URL: http://www.easymock.org Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/649/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/easymock -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2134991

1 7

[Bug 2211812] New: resteasy-6.2.4.Final is available
by bugzilla＠redhat.com 12 Nov '24

12 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2211812 Bug ID: 2211812 Summary: resteasy-6.2.4.Final is available Product: Fedora Version: rawhide Status: NEW Component: resteasy Keywords: FutureFeature, Triaged Assignee: edewata(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, alexander.m.scheel(a)gmail.com, cfu(a)redhat.com, ckelley(a)redhat.com, dchen(a)redhat.com, edewata(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jmagne(a)redhat.com, mfargett(a)redhat.com, mharmsen(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Releases retrieved: 3.15.7.Final Upstream release that is considered latest: 6.2.4.Final Current version/release in rawhide: 3.0.26-25.fc39 URL: https://resteasy.dev/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/11453/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/resteasy -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2211812

1 8

[Bug 2232943] New: apache-ivy-2.5.2 is available
by bugzilla＠redhat.com 07 Nov '24

07 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2232943 Bug ID: 2232943 Summary: apache-ivy-2.5.2 is available Product: Fedora Version: rawhide Status: NEW Component: apache-ivy Keywords: FutureFeature, Triaged Assignee: didiksupriadi41(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: didiksupriadi41(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, lkundrak(a)v3.sk, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 2.5.2 Upstream release that is considered latest: 2.5.2 Current version/release in rawhide: 2.5.1-6.fc39 URL: https://ant.apache.org/ivy/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/14014/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/apache-ivy -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2232943 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 8

[Bug 2240907] New: jboss-parent-40 is available
by bugzilla＠redhat.com 07 Nov '24

07 Nov '24

https://bugzilla.redhat.com/show_bug.cgi?id=2240907 Bug ID: 2240907 Summary: jboss-parent-40 is available Product: Fedora Version: rawhide Status: NEW Component: jboss-parent Keywords: FutureFeature, Triaged Assignee: edewata(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: alexander.m.scheel(a)gmail.com, cfu(a)redhat.com, ckelley(a)redhat.com, edewata(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jmagne(a)redhat.com, mfargett(a)redhat.com, mharmsen(a)redhat.com, mizdebsk(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Releases retrieved: 40 Upstream release that is considered latest: 40 Current version/release in rawhide: 20-18.fc39 URL: http://www.jboss.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/20436/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/jboss-parent -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2240907 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 7

[Bug 2078122] New: maven-reporting-impl-4.0.0-M1 is available
by bugzilla＠redhat.com 15 Oct '24

15 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2078122 Bug ID: 2078122 Summary: maven-reporting-impl-4.0.0-M1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-reporting-impl Keywords: FutureFeature, Triaged Assignee: loganjerry(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, loganjerry(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 4.0.0-M1 Current version/release in rawhide: 3.1.0-1.fc37 URL: http://maven.apache.org/shared/maven-reporting-impl/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1932/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2078122

1 9

[Bug 2207629] New: mysql-connector-java-8.0.33 is available
by bugzilla＠redhat.com 15 Oct '24

15 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2207629 Bug ID: 2207629 Summary: mysql-connector-java-8.0.33 is available Product: Fedora Version: rawhide Status: NEW Component: mysql-connector-java Keywords: FutureFeature, Triaged Assignee: zmiklank(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, ljavorsk(a)redhat.com, mkulik(a)redhat.com, mschorm(a)redhat.com, puntogil(a)libero.it, steve.traylen(a)cern.ch, zmiklank(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 8.0.33 Upstream release that is considered latest: 8.0.33 Current version/release in rawhide: 8.0.30-2.fc38 URL: http://dev.mysql.com/downloads/connector/j/?os=26 Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/2038/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/mysql-connector-java -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2207629

1 8

[Bug 2033800] New: maven-doxia-sitetools-1.11.1 is available
by bugzilla＠redhat.com 09 Oct '24

09 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2033800 Bug ID: 2033800 Summary: maven-doxia-sitetools-1.11.1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-doxia-sitetools Keywords: FutureFeature, Triaged Assignee: loganjerry(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, loganjerry(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 1.11.1 Current version/release in rawhide: 1.9.2-5.fc35 URL: http://maven.apache.org/doxia/doxia-sitetools/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1905/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2033800

1 9

[Bug 2238928] New: weld-parent-47 is available
by bugzilla＠redhat.com 09 Oct '24

09 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2238928 Bug ID: 2238928 Summary: weld-parent-47 is available Product: Fedora Version: rawhide Status: NEW Component: weld-parent Keywords: FutureFeature, Triaged Assignee: markku.korkeala(a)kapsi.fi Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, markku.korkeala(a)kapsi.fi, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Releases retrieved: 47 Upstream release that is considered latest: 47 Current version/release in rawhide: 46-5.fc39 URL: http://weld.cdi-spec.org Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/20402/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/weld-parent -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2238928 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 6

[Bug 2129085] New: batik-1.15 is available
by bugzilla＠redhat.com 09 Oct '24

09 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2129085 Bug ID: 2129085 Summary: batik-1.15 is available Product: Fedora Version: rawhide Status: NEW Component: batik Keywords: FutureFeature, Triaged Assignee: mat.booth(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com, mat.booth(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 1.15 Upstream release that is considered latest: 1.15 Current version/release in rawhide: 1.14-7.fc37 URL: https://xmlgraphics.apache.org/batik/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/168/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/batik -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2129085

1 4

[Bug 2255773] New: plexus-velocity-2.1.0 is available
by bugzilla＠redhat.com 06 Oct '24

06 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2255773 Bug ID: 2255773 Summary: plexus-velocity-2.1.0 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-velocity Keywords: FutureFeature, Triaged Assignee: markku.korkeala(a)kapsi.fi Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, markku.korkeala(a)kapsi.fi, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 2.1.0 Upstream release that is considered latest: 2.1.0 Current version/release in rawhide: 2.0-2.fc40 URL: https://codehaus-plexus.github.io/plexus-velocity/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/3664/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/plexus-velocity -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2255773 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 1

[Bug 2077137] New: maven-reporting-api-4.0.0-M1 is available
by bugzilla＠redhat.com 06 Oct '24

06 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2077137 Bug ID: 2077137 Summary: maven-reporting-api-4.0.0-M1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-reporting-api Keywords: FutureFeature, Triaged Assignee: loganjerry(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, loganjerry(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 4.0.0-M1 Current version/release in rawhide: 3.1.0-1.fc36 URL: https://maven.apache.org/shared/maven-reporting-api/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1931/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2077137

1 9

[Bug 2028618] New: maven-doxia-1.11.1 is available
by bugzilla＠redhat.com 01 Oct '24

01 Oct '24

https://bugzilla.redhat.com/show_bug.cgi?id=2028618 Bug ID: 2028618 Summary: maven-doxia-1.11.1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-doxia Keywords: FutureFeature, Triaged Assignee: loganjerry(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, loganjerry(a)gmail.com, mefoster(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 1.11.1 Current version/release in rawhide: 1.9.1-5.fc35 URL: http://maven.apache.org/doxia/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1903/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2028618

1 10

[Bug 1892123] New: google-guice-5.0.0-BETA-1 is available
by bugzilla＠redhat.com 28 Aug '24

28 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=1892123 Bug ID: 1892123 Summary: google-guice-5.0.0-BETA-1 is available Product: Fedora Version: rawhide Status: NEW Component: google-guice Keywords: FutureFeature, Triaged Assignee: java-maint-sig(a)lists.fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-maint-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, sochotni(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 5.0.0-BETA-1 Current version/release in rawhide: 4.2.3-3.fc33 URL: https://github.com/google/guice Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1231/ -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1884968] New: cdi-api-2.0.1 is available
by bugzilla＠redhat.com 26 Aug '24

26 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=1884968 Bug ID: 1884968 Summary: cdi-api-2.0.1 is available Product: Fedora Version: rawhide Status: NEW Component: cdi-api Keywords: FutureFeature, Triaged Assignee: java-maint-sig(a)lists.fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-maint-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Latest upstream release: 2.0.1 Current version/release in rawhide: 2.0-1.fc34 URL: http://cdi-spec.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/20387/ -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 1884967] New: atinject-2.0.0-RC2 is available
by bugzilla＠redhat.com 26 Aug '24

26 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=1884967 Bug ID: 1884967 Summary: atinject-2.0.0-RC2 is available Product: Fedora Version: rawhide Status: NEW Component: atinject Keywords: FutureFeature, Triaged Assignee: java-maint-sig(a)lists.fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-maint-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, sochotni(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 2.0.0-RC2 Current version/release in rawhide: 1-35.20100611svn86.fc33 URL: http://javax-inject.github.io/javax-inject/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/129/ -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1798524] New: CVE-2019-20444 netty: HTTP request smuggling
by bugzilla＠redhat.com 26 Aug '24

26 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=1798524 Bug ID: 1798524 Summary: CVE-2019-20444 netty: HTTP request smuggling Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, aos-bugs(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcantril(a)redhat.com, jerboaa(a)gmail.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jross(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lgao(a)redhat.com, loleary(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, rchan(a)redhat.com, rguimara(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sdaley(a)redhat.com, smaestri(a)redhat.com, sochotni(a)redhat.com, sokeeffe(a)redhat.com, spinder(a)redhat.com, sponnaga(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org, sthorger(a)redhat.com, tbrisker(a)redhat.com, theute(a)redhat.com, tom.jenkinson(a)redhat.com Target Milestone: --- Classification: Other A vulnerability was found in HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold." Reference: https://github.com/netty/netty/issues/9866 https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Fi… -- You are receiving this mail because: You are on the CC list for the bug.

1 57

[Bug 1798509] New: CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header
by bugzilla＠redhat.com 26 Aug '24

26 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=1798509 Bug ID: 1798509 Summary: CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, aos-bugs(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcantril(a)redhat.com, jerboaa(a)gmail.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jross(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lgao(a)redhat.com, loleary(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, rchan(a)redhat.com, rguimara(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sdaley(a)redhat.com, smaestri(a)redhat.com, sochotni(a)redhat.com, sokeeffe(a)redhat.com, spinder(a)redhat.com, sponnaga(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org, sthorger(a)redhat.com, tbrisker(a)redhat.com, theute(a)redhat.com, tom.jenkinson(a)redhat.com Target Milestone: --- Classification: Other A vulnerability was found in HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. Reference: https://github.com/netty/netty/compare/netty-4.1.43.Final...netty-4.1.44.Fi… https://github.com/netty/netty/issues/9861 https://lists.apache.org/thread.html/r310d2ce22304d5298ff87f10134f918c87919… https://lists.apache.org/thread.html/r36fcf538b28f2029e8b4f6b9a772f3b107913… https://lists.apache.org/thread.html/r640eb9b3213058a963e18291f903fc1584e57… https://lists.apache.org/thread.html/r70b1ff22ee80e8101805b9a473116dd332657… https://lists.apache.org/thread.html/r804895eedd72c9ec67898286eb185e04df852… https://lists.apache.org/thread.html/r81700644754e66ffea465c869cb477de25f80… https://lists.apache.org/thread.html/r96e08f929234e8ba1ef4a93a0fd2870f535a1… https://lists.apache.org/thread.html/r9b20cdac704cf9a583400350e2d5b576fa841… https://lists.apache.org/thread.html/ra2ace4bcb5cf487f72cbcbfa0f8cc08e755ec… https://lists.apache.org/thread.html/ra9fbfe7d4830ae675bf34c7c0f8c22fc8a409… https://lists.apache.org/thread.html/rce71d33747010d32d31d90f5d737dae26291d… https://lists.apache.org/thread.html/re45ee9256d3233c31d78e59ee59c7dc841c7f… https://lists.apache.org/thread.html/rfb55f245b08d8a6ec0fb4dc159022227cd22d… https://lists.apache.org/thread.html/rff210a24f3a924829790e69eaefa84820902b… -- You are receiving this mail because: You are on the CC list for the bug.

1 56

[Bug 1775293] New: cve jackson-databind: default typing leads to code execution
by bugzilla＠redhat.com 26 Aug '24

26 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=1775293 Bug ID: 1775293 Summary: cve jackson-databind: default typing leads to code execution Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cbyrne(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, cmacedo(a)redhat.com, darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com, dffrench(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, drusso(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, hhorak(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jmadigan(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jshepherd(a)redhat.com, jstastny(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mat.booth(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, ngough(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, pwright(a)redhat.com, rchan(a)redhat.com, rguimara(a)redhat.com, rhcs-maint(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sdaley(a)redhat.com, smaestri(a)redhat.com, sokeeffe(a)redhat.com, sponnaga(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org, sthorger(a)redhat.com, swoodman(a)redhat.com, tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com, trepel(a)redhat.com, trogers(a)redhat.com, twalsh(a)redhat.com Target Milestone: --- Classification: Other A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload. Reference: https://github.com/FasterXML/jackson-databind/issues/2498 -- You are receiving this mail because: You are on the CC list for the bug.

1 51

[Bug 1767483] New: CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default
by bugzilla＠redhat.com 26 Aug '24

26 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=1767483 Bug ID: 1767483 Summary: CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bkearney(a)redhat.com, dblechte(a)redhat.com, decathorpe(a)gmail.com, dfediuck(a)redhat.com, eedri(a)redhat.com, fnasser(a)redhat.com, hhorak(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jorton(a)redhat.com, mgoldboi(a)redhat.com, mhroncok(a)redhat.com, michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com, omajid(a)redhat.com, qe-baseos-apps(a)redhat.com, sbonazzo(a)redhat.com, sgehwolf(a)redhat.com, sherold(a)redhat.com, SpikeFedora(a)gmail.com, stewardship-sig(a)lists.fedoraproject.org, tlestach(a)redhat.com, yturgema(a)redhat.com Target Milestone: --- Classification: Other In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. Reference: http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC62879… -- You are receiving this mail because: You are on the CC list for the bug.

1 72

[Bug 1737517] New: CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution
by bugzilla＠redhat.com 26 Aug '24

26 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=1737517 Bug ID: 1737517 Summary: CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: msiddiqu(a)redhat.com CC: ahardin(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bleanhar(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cbyrne(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, cmacedo(a)redhat.com, darran.lofthouse(a)redhat.com, dbecker(a)redhat.com, dedgar(a)redhat.com, dffrench(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, drusso(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, hhorak(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jgoulding(a)redhat.com, jjoyce(a)redhat.com, jkurik(a)redhat.com, jmadigan(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschatte(a)redhat.com, jschluet(a)redhat.com, jshepherd(a)redhat.com, jstastny(a)redhat.com, kbasil(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, lpetrovi(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mat.booth(a)redhat.com, mburns(a)redhat.com, mchappel(a)redhat.com, mhulan(a)redhat.com, mkolesni(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, ngough(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, pwright(a)redhat.com, rchan(a)redhat.com, rguimara(a)redhat.com, rhcs-maint(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sclewis(a)redhat.com, scohen(a)redhat.com, sdaley(a)redhat.com, slinaber(a)redhat.com, smaestri(a)redhat.com, sthorger(a)redhat.com, tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com, trepel(a)redhat.com, trogers(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com Target Milestone: --- Classification: Other SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used, leading to remote code execution. References: https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.… Upstream issue: https://github.com/FasterXML/jackson-databind/issues/2387 -- You are receiving this mail because: You are on the CC list for the bug.

1 55

[Bug 1725807] New: CVE-2019-12384 jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution
by bugzilla＠redhat.com 26 Aug '24

26 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=1725807 Bug ID: 1725807 Summary: CVE-2019-12384 jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190621,reported=20190625,sour ce=cve,cvss3=8.1/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/ I:H/A:H,cwe=CWE-502,fedora-all/jackson-databind=affect ed,amq-6/jackson-databind=new,amq-st/jackson-databind= new,bpms-6/jackson-databind=new,openstack-8/opendaylig ht=new,openstack-9/opendaylight=new,openstack-10/opend aylight=new,openstack-13/opendaylight=new,openstack-14 /opendaylight=new,rhsso-7/jackson-databind=new,vertx-3 /jackson-databind=new,swarm-7/jackson-databind=new,rhe l-8/pki-deps:10.6/jackson-databind=new,rhn_satellite_6 /jackson-databind=new,rhscl-3/rh-maven35-jackson-datab ind=new,rhdm-7/jackson-databind=new,rhpam-7/jackson-da tabind=new,fuse-6/jackson-databind=new,fuse-7/jackson- databind=new,eap-7/jackson-databind=new,rhmap-4/jackso n-databind=new,openshift-enterprise-3/ose-logging-elas ticsearch5=new Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: msiddiqu(a)redhat.com CC: ahardin(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, bleanhar(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, btotty(a)redhat.com, cbyrne(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, cmacedo(a)redhat.com, darran.lofthouse(a)redhat.com, dbecker(a)redhat.com, dedgar(a)redhat.com, dffrench(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, drusso(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ggaughan(a)redhat.com, hhorak(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jgoulding(a)redhat.com, jjoyce(a)redhat.com, jkurik(a)redhat.com, jmadigan(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschluet(a)redhat.com, jshepherd(a)redhat.com, kbasil(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, lpetrovi(a)redhat.com, lthon(a)redhat.com, lzap(a)redhat.com, mat.booth(a)redhat.com, mburns(a)redhat.com, mchappel(a)redhat.com, mhulan(a)redhat.com, mkolesni(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, ngough(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pgallagh(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, pwright(a)redhat.com, rchan(a)redhat.com, rguimara(a)redhat.com, rhcs-maint(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sclewis(a)redhat.com, scohen(a)redhat.com, sdaley(a)redhat.com, slinaber(a)redhat.com, smaestri(a)redhat.com, sthorger(a)redhat.com, tbrisker(a)redhat.com, tom.jenkinson(a)redhat.com, trepel(a)redhat.com, trogers(a)redhat.com, twalsh(a)redhat.com Target Milestone: --- Classification: Other FasterXML jackson-databind 2.x before 2.9.9 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible. Upstream issue: https://github.com/FasterXML/jackson-databind/issues/2334 Upstream patch: https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6… References: https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html -- You are receiving this mail because: You are on the CC list for the bug.

1 75

[Bug 2083856] New: sisu-0.9.0.M1 is available
by bugzilla＠redhat.com 20 Aug '24

20 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2083856 Bug ID: 2083856 Summary: sisu-0.9.0.M1 is available Product: Fedora Version: rawhide Status: NEW Component: sisu Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 0.9.0.M1 Current version/release in rawhide: 0.3.5-1.fc37 URL: http://eclipse.org/sisu Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/20407/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2083856

1 10

[Bug 2232716] New: pdfbox-3.0.0 is available
by bugzilla＠redhat.com 09 Aug '24

09 Aug '24

https://bugzilla.redhat.com/show_bug.cgi?id=2232716 Bug ID: 2232716 Summary: pdfbox-3.0.0 is available Product: Fedora Version: rawhide Status: NEW Component: pdfbox Keywords: FutureFeature, Triaged Assignee: jvanek(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: didiksupriadi41(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com, puntogil(a)libero.it, sergio(a)serjux.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.0.0 Upstream release that is considered latest: 3.0.0 Current version/release in rawhide: 2.0.29-2.fc39 URL: http://pdfbox.apache.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/9648/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/pdfbox -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2232716 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 17

[Bug 2211537] New: truth-1.1.4 is available
by bugzilla＠redhat.com 16 Jul '24

16 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2211537 Bug ID: 2211537 Summary: truth-1.1.4 is available Product: Fedora Version: rawhide Status: NEW Component: truth Keywords: FutureFeature, Triaged Assignee: orion(a)nwra.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, orion(a)nwra.com Target Milestone: --- Classification: Fedora Releases retrieved: 1.1.4 Upstream release that is considered latest: 1.1.4 Current version/release in rawhide: 1.0.1-6.fc38 URL: https://github.com/google/truth Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/6624/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/truth -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2211537

1 26

[Bug 2231137] New: TRIAGE-CVE-2023-38210 xmpcore: Uncontrolled Resource Consumption [epel-7]
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2231137 Bug ID: 2231137 Summary: TRIAGE-CVE-2023-38210 xmpcore: Uncontrolled Resource Consumption [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: xmpcore Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: extras-orphan(a)fedoraproject.org Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2231135 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2231137 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2173752] New: CVE-2023-24998 apache-commons-fileupload: Apache Commons FileUpload: FileUpload DoS with excessive parts [epel-7]
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2173752 Bug ID: 2173752 Summary: CVE-2023-24998 apache-commons-fileupload: Apache Commons FileUpload: FileUpload DoS with excessive parts [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: apache-commons-fileupload Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: jjelen(a)redhat.com Reporter: chazlett(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, jjelen(a)redhat.com, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2172298 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2173752

1 3

[Bug 2083443] New: Please release it for EPEL8
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2083443 Bug ID: 2083443 Summary: Please release it for EPEL8 Product: Fedora EPEL Version: epel7 Status: NEW Component: nosync Assignee: mizdebsk(a)redhat.com Reporter: bugzilla(a)terrortux.de QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Until now, it is missing for EPEL-8 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2083443

1 1

[Bug 2058765] New: CVE-2022-24613 metadata-extractor: Various uncaught exceptions while parsing a specially crafted JPEG file
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2058765 Bug ID: 2058765 Summary: CVE-2022-24613 metadata-extractor: Various uncaught exceptions while parsing a specially crafted JPEG file Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aileenc(a)redhat.com, alazarot(a)redhat.com, anstephe(a)redhat.com, bibryam(a)redhat.com, cedric.olivier(a)free.fr, chazlett(a)redhat.com, drieden(a)redhat.com, emingora(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gmalinko(a)redhat.com, hbraun(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jochrist(a)redhat.com, jolee(a)redhat.com, jrokos(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, mnovotny(a)redhat.com, pantinor(a)redhat.com, pdelbell(a)redhat.com, pjindal(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, tzimanyi(a)redhat.com Target Milestone: --- Classification: Other metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library. Upstream bug: https://github.com/drewnoakes/metadata-extractor/issues/561 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2058765

1 4

[Bug 2068598] New: CVE-2022-24613 metadata-extractor2: metadata-extractor: Various uncaught exceptions while parsing a specially crafted JPEG file [epel-7]
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2068598 Bug ID: 2068598 Summary: CVE-2022-24613 metadata-extractor2: metadata-extractor: Various uncaught exceptions while parsing a specially crafted JPEG file [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: metadata-extractor2 Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: cedric.olivier(a)free.fr Reporter: pdelbell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: cedric.olivier(a)free.fr, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-7. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2068598

1 4

[Bug 2058763] New: CVE-2022-24614 metadata-extractor: Out-of-memory when reading a specially crafted JPEG file
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2058763 Bug ID: 2058763 Summary: CVE-2022-24614 metadata-extractor: Out-of-memory when reading a specially crafted JPEG file Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aileenc(a)redhat.com, alazarot(a)redhat.com, anstephe(a)redhat.com, bibryam(a)redhat.com, cedric.olivier(a)free.fr, chazlett(a)redhat.com, drieden(a)redhat.com, emingora(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gmalinko(a)redhat.com, hbraun(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jochrist(a)redhat.com, jolee(a)redhat.com, jrokos(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, mnovotny(a)redhat.com, pantinor(a)redhat.com, pdelbell(a)redhat.com, pjindal(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, tzimanyi(a)redhat.com Target Milestone: --- Classification: Other When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library. Upstream bug: https://github.com/drewnoakes/metadata-extractor/issues/561 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2058763

1 8

[Bug 2068597] New: CVE-2022-24614 metadata-extractor2: metadata-extractor: Out-of-memory when reading a specially crafted JPEG file [epel-7]
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2068597 Bug ID: 2068597 Summary: CVE-2022-24614 metadata-extractor2: metadata-extractor: Out-of-memory when reading a specially crafted JPEG file [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: metadata-extractor2 Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: cedric.olivier(a)free.fr Reporter: pdelbell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: cedric.olivier(a)free.fr, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-7. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2068597

1 4

[Bug 1893298] New: CVE-2020-7760 codemirror: ReDoS in tokenBase function in javascript.js
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1893298 Bug ID: 1893298 Summary: CVE-2020-7760 codemirror: ReDoS in tokenBase function in javascript.js Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: bmontgom(a)redhat.com, cmeyers(a)redhat.com, eparis(a)redhat.com, extras-orphan(a)fedoraproject.org, gblomqui(a)redhat.com, gmainwar(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jokerman(a)redhat.com, mabashia(a)redhat.com, mizdebsk(a)redhat.com, moceap(a)hotmail.com, msrb(a)redhat.com, notting(a)redhat.com, nstielau(a)redhat.com, rpetrell(a)redhat.com, smcdonal(a)redhat.com, sponnaga(a)redhat.com, viktor.vix.jancik(a)gmail.com Target Milestone: --- Classification: Other This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736…. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)* Reference: https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937 Upstream patch: https://github.com/codemirror/CodeMirror/commit/55d0333907117c9231ffdf555ae… -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1801380] New: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1801380 Bug ID: 1801380 Summary: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jochrist(a)redhat.com, jperkins(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pdrozd(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sdaley(a)redhat.com, smaestri(a)redhat.com, sthorger(a)redhat.com, tom.jenkinson(a)redhat.com Target Milestone: --- Classification: Other CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input within the header of encoded data. Reference: https://github.com/vt-middleware/cryptacular/issues/52 -- You are receiving this mail because: You are on the CC list for the bug.

1 28

[Bug 1801382] New: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation [epel-7]
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1801382 Bug ID: 1801382 Summary: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: cryptacular Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: lef(a)fedoraproject.org Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-7. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1709860] New: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1709860 Bug ID: 1709860 Summary: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service Product: Security Response Hardware: All OS: Linux Status: NEW Whiteboard: impact=moderate,public=20190417,reported=20190424,sour ce=cve,cvss3=7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/ I:N/A:H,cwe=CWE-776,fedora-all/c3p0=affected,epel-7/c3 p0=affected,rhes-3/c3p0=new,rhpam-7/c3p0=new,fuse-6/c3 p0=new,fuse-7/c3p0=new,rhn_satellite_6/c3p0=new,jbews- 2/c3p0=new,rhn_satellite_5/c3p0=new,rhmap-4/c3p0=new,v ertx-3/c3p0=new,soap-5/c3p0=new,bpms-6/c3p0=new Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: msiddiqu(a)redhat.com CC: aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, avibelli(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bgeorges(a)redhat.com, bkearney(a)redhat.com, btotty(a)redhat.com, cbyrne(a)redhat.com, chazlett(a)redhat.com, cmacedo(a)redhat.com, csutherl(a)redhat.com, decathorpe(a)gmail.com, dffrench(a)redhat.com, dingyichen(a)gmail.com, drusso(a)redhat.com, etirelli(a)redhat.com, ggainey(a)redhat.com, gvarsami(a)redhat.com, gzaronik(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jmadigan(a)redhat.com, jochrist(a)redhat.com, jpallich(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lef(a)fedoraproject.org, lgao(a)redhat.com, lpetrovi(a)redhat.com, lthon(a)redhat.com, mat.booth(a)redhat.com, mbabacek(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, mszynkie(a)redhat.com, myarboro(a)redhat.com, ngough(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pgallagh(a)redhat.com, ppenicka(a)redhat.com, pwright(a)redhat.com, rchan(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sdaley(a)redhat.com, sisharma(a)redhat.com, smohan(a)redhat.com, ssaha(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org, tcunning(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, trepel(a)redhat.com, trogers(a)redhat.com, twalsh(a)redhat.com, vbellur(a)redhat.com, weli(a)redhat.com Target Milestone: --- Classification: Other c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration. References: https://hackerone.com/reports/509315 http://www.cvedetails.com/cve/CVE-2019-5427/ Upstream commit: https://github.com/swaldman/c3p0/commit/f38f27635c384806c2a9d6500d80183d9f0… -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1709862] New: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service [epel-7]
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1709862 Bug ID: 1709862 Summary: CVE-2019-5427 c3p0: loading XML configuration leads to denial of service [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: c3p0 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: dingyichen(a)gmail.com Reporter: msiddiqu(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, dingyichen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, mat.booth(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-7. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1664731] New: CVE-2018-20433 c3p0: XML external entity processing in extractXmlConfigFromInputStream [epel-7]
by bugzilla＠redhat.com 08 Jul '24

08 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1664731 Bug ID: 1664731 Summary: CVE-2018-20433 c3p0: XML external entity processing in extractXmlConfigFromInputStream [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: c3p0 Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: dingyichen(a)gmail.com Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dingyichen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, mat.booth(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-7. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 2245325] New: maven-plugin-tools-3.10.1 is available
by bugzilla＠redhat.com 03 Jul '24

03 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2245325 Bug ID: 2245325 Summary: maven-plugin-tools-3.10.1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-plugin-tools Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.10.1 Upstream release that is considered latest: 3.10.1 Current version/release in rawhide: 3.9.0-2.fc40 URL: http://maven.apache.org/plugin-tools/index.html Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1925/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/maven-plugin-tools -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2245325 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 7

[Bug 2173541] New: maven-plugin-testing-4.0.0-alpha-1 is available
by bugzilla＠redhat.com 03 Jul '24

03 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=2173541 Bug ID: 2173541 Summary: maven-plugin-testing-4.0.0-alpha-1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-plugin-testing Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, yyang(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 4.0.0-alpha-1 Upstream release that is considered latest: 4.0.0-alpha-1 Current version/release in rawhide: 3.3.0-27.fc38 URL: http://maven.apache.org/plugin-testing/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1924/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/maven-plugin-testing -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2173541

1 2

[Bug 1748421] New: httpcomponents-core-4.4.12 is available
by bugzilla＠redhat.com 03 Jul '24

03 Jul '24

https://bugzilla.redhat.com/show_bug.cgi?id=1748421 Bug ID: 1748421 Summary: httpcomponents-core-4.4.12 is available Product: Fedora Version: rawhide Status: NEW Component: httpcomponents-core Keywords: FutureFeature, Triaged Assignee: stuart(a)gathman.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com, sochotni(a)redhat.com, stuart(a)gathman.org Target Milestone: --- Classification: Fedora Latest upstream release: 4.4.12 Current version/release in rawhide: 4.4.10-6.fc31 URL: http://www.apache.org/dist/httpcomponents/httpcore/source/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1333/ -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 2129818] New: snakeyaml-1.33 is available
by bugzilla＠redhat.com 21 Jun '24

21 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=2129818 Bug ID: 2129818 Summary: snakeyaml-1.33 is available Product: Fedora Version: rawhide Status: NEW Component: snakeyaml Keywords: FutureFeature, Triaged Assignee: jerboaa(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: fedoraproject.org(a)bluhm-de.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, mizdebsk(a)redhat.com, mo(a)morsi.org Target Milestone: --- Classification: Fedora Releases retrieved: 1.33 Upstream release that is considered latest: 1.33 Current version/release in rawhide: 1.32-1.fc38 URL: https://bitbucket.org/asomov/snakeyaml/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/4842/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/snakeyaml -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2129818

1 4

[Bug 2158760] New: CVE-2022-45143 tomcat: JsonErrorReportValve injection [epel-all]
by bugzilla＠redhat.com 18 Jun '24

18 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=2158760 Bug ID: 2158760 Summary: CVE-2022-45143 tomcat: JsonErrorReportValve injection [epel-all] Product: Fedora EPEL Version: epel8 Status: NEW Component: tomcat Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: csutherl(a)redhat.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2158695 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2158760

1 5

[Bug 2190215] New: Make Tomcat 10 available through EPEL
by bugzilla＠redhat.com 18 Jun '24

18 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=2190215 Bug ID: 2190215 Summary: Make Tomcat 10 available through EPEL Product: Fedora EPEL Version: epel9 Status: NEW Component: tomcat Assignee: csutherl(a)redhat.com Reporter: csutherl(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora We've had a few users requesting Tomcat 10 be added to EPEL. I've created this bugzilla to track those requests and to have a place to share status updates. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2190215

1 3

[Bug 2241426] New: apache-commons-io-2.14.0 is available
by bugzilla＠redhat.com 05 Jun '24

05 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=2241426 Bug ID: 2241426 Summary: apache-commons-io-2.14.0 is available Product: Fedora Version: rawhide Status: NEW Component: apache-commons-io Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com, stuart(a)gathman.org Target Milestone: --- Classification: Fedora Releases retrieved: 2.14.0 Upstream release that is considered latest: 2.14.0 Current version/release in rawhide: 2.13.0-4.fc40 URL: http://www.apache.org/dist/commons/io/source/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/72/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/apache-commons-io -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2241426 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 7

[Bug 1870860] New: auto-1.7.4 is available
by bugzilla＠redhat.com 01 Jun '24

01 Jun '24

https://bugzilla.redhat.com/show_bug.cgi?id=1870860 Bug ID: 1870860 Summary: auto-1.7.4 is available Product: Fedora Version: rawhide Status: NEW Component: auto Keywords: FutureFeature, Triaged Assignee: mat.booth(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, mat.booth(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Latest upstream release: 1.7.4 Current version/release in rawhide: 1.5.4-4.fc33 URL: https://github.com/google/auto Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/6371/ -- You are receiving this mail because: You are on the CC list for the bug.

1 33

[Bug 2254198] New: tomcat-10.1.17 is available
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2254198 Bug ID: 2254198 Summary: tomcat-10.1.17 is available Product: Fedora Version: rawhide Status: NEW Component: tomcat Keywords: FutureFeature, Triaged Assignee: huwang(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Releases retrieved: 10.1.17 Upstream release that is considered latest: 10.1.17 Current version/release in rawhide: 9.0.83-1.fc40 URL: https://tomcat.apache.org/whichversion.html Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/323798/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/tomcat -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2254198 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 25

[Bug 2251918] New: TRIAGE CVE-2023-34055 log4j: spring-boot: org.springframework.boot:spring-boot-actuator class vulnerable to denial of service [fedora-all]
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2251918 Bug ID: 2251918 Summary: TRIAGE CVE-2023-34055 log4j: spring-boot: org.springframework.boot:spring-boot-actuator class vulnerable to denial of service [fedora-all] Product: Fedora Version: 38 Status: NEW Component: log4j Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: paul.wouters(a)aiven.io Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: devrim(a)gunduz.org, elijahward.dev(a)gmail.com, italo.garcia+fedora(a)aiven.io, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, rj.layco(a)gmail.com, rominf(a)aiven.io Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2251917 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2251918 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2251284] New: TRIAGE CVE-2023-33202 apache-sshd: bc-java: Out of memory while parsing ASN.1 crafted data in org.bouncycastle.openssl.PEMParser class [fedora-all]
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2251284 Bug ID: 2251284 Summary: TRIAGE CVE-2023-33202 apache-sshd: bc-java: Out of memory while parsing ASN.1 crafted data in org.bouncycastle.openssl.PEMParser class [fedora-all] Product: Fedora Version: 38 Status: NEW Component: apache-sshd Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: mat.booth(a)gmail.com Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)gmail.com, msrb(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2251281 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2251284 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2251282] New: TRIAGE CVE-2023-33202 log4j: bc-java: Out of memory while parsing ASN.1 crafted data in org.bouncycastle.openssl.PEMParser class [fedora-all]
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2251282 Bug ID: 2251282 Summary: TRIAGE CVE-2023-33202 log4j: bc-java: Out of memory while parsing ASN.1 crafted data in org.bouncycastle.openssl.PEMParser class [fedora-all] Product: Fedora Version: 38 Status: NEW Component: log4j Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: paul.wouters(a)aiven.io Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: devrim(a)gunduz.org, elijahward.dev(a)gmail.com, italo.garcia+fedora(a)aiven.io, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, rj.layco(a)gmail.com, rominf(a)aiven.io Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2251281 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2251282 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2245807] New: CVE-2023-36478 jetty: hpack header values cause [fedora-all]
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2245807 Bug ID: 2245807 Summary: CVE-2023-36478 jetty: hpack header values cause [fedora-all] Product: Fedora Version: 38 Status: NEW Component: jetty Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: mat.booth(a)gmail.com Reporter: ybuenos(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jjohnstn(a)redhat.com, mat.booth(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2243123 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2245807 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2244893] New: CVE-2023-44981 zookeeper: Authorization Bypass in Apache ZooKeeper [fedora-all]
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2244893 Bug ID: 2244893 Summary: CVE-2023-44981 zookeeper: Authorization Bypass in Apache ZooKeeper [fedora-all] Product: Fedora Version: 38 Status: NEW Component: zookeeper Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: extras-orphan(a)fedoraproject.org Reporter: ntait(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: ctubbsii(a)fedoraproject.org, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2243436 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2244893 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2243327] New: [Major Incident] CVE-2023-44487 jetty: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [fedora-all]
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2243327 Bug ID: 2243327 Summary: [Major Incident] CVE-2023-44487 jetty: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [fedora-all] Product: Fedora Version: 38 Status: NEW Component: jetty Keywords: Security, SecurityTracking Severity: high Priority: urgent Assignee: mat.booth(a)gmail.com Reporter: askrabec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jjohnstn(a)redhat.com, mat.booth(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2242803 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2243327 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2242517] New: CVE-2023-37460 plexus-archiver: Arbitrary File Creation in AbstractUnArchiver [fedora-38]
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2242517 Bug ID: 2242517 Summary: CVE-2023-37460 plexus-archiver: Arbitrary File Creation in AbstractUnArchiver [fedora-38] Product: Fedora Version: 38 Status: NEW Component: plexus-archiver Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: mizdebsk(a)redhat.com Reporter: ntait(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2242288 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2242517 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2239842] New: TRIAGE-CVE-2023-36479 jetty: Improper addition of quotation marks to user inputs in CgiServlet [fedora-all]
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2239842 Bug ID: 2239842 Summary: TRIAGE-CVE-2023-36479 jetty: Improper addition of quotation marks to user inputs in CgiServlet [fedora-all] Product: Fedora Version: 38 Status: NEW Component: jetty Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: mat.booth(a)gmail.com Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jjohnstn(a)redhat.com, mat.booth(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2239630 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2239842 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2236342] New: CVE-2023-26049 log4j: jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies [fedora-all]
by bugzilla＠redhat.com 31 May '24

31 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2236342 Bug ID: 2236342 Summary: CVE-2023-26049 log4j: jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies [fedora-all] Product: Fedora Version: 38 Status: NEW Component: log4j Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: paul.wouters(a)aiven.io Reporter: pdelbell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: devrim(a)gunduz.org, italo.garcia+fedora(a)aiven.io, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, rj.layco(a)gmail.com, rominf(a)aiven.io Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2236341 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2236342 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2252051] New: TRIAGE CVE-2023-46589 tomcat: HTTP request smuggling via malformed trailer headers [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2252051 Bug ID: 2252051 Summary: TRIAGE CVE-2023-46589 tomcat: HTTP request smuggling via malformed trailer headers [fedora-all] Product: Fedora Version: 38 Status: NEW Component: tomcat Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: huwang(a)redhat.com Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2252050 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2252051 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2244337] New: Wrong dbcp class in tomcat 9
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2244337 Bug ID: 2244337 Summary: Wrong dbcp class in tomcat 9 Product: Fedora Version: 39 OS: Linux Status: NEW Component: tomcat Severity: medium Assignee: huwang(a)redhat.com Reporter: huwang(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora File tomcat.conf contains: JAVA_OPTS="-Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory" It should be: JAVA_OPTS="-Djavax.sql.DataSource.Factory=org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory" The dbcp class does not exist in TC 9, which switch to dbcp2. Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2244337 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 2

[Bug 2244343] New: Wrong dbcp class in tomcat 9
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2244343 Bug ID: 2244343 Summary: Wrong dbcp class in tomcat 9 Product: Fedora Version: 38 OS: Linux Status: NEW Component: tomcat Severity: medium Assignee: huwang(a)redhat.com Reporter: huwang(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora File tomcat.conf contains: JAVA_OPTS="-Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory" It should be: JAVA_OPTS="-Djavax.sql.DataSource.Factory=org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory" The dbcp class does not exist in TC 9, which switch to dbcp2. Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2244343 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 2

[Bug 2243613] New: [Major Incident] CVE-2023-44487 tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2243613 Bug ID: 2243613 Summary: [Major Incident] CVE-2023-44487 tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) [fedora-all] Product: Fedora Version: 38 Status: NEW Component: tomcat Keywords: Security, SecurityTracking Severity: high Priority: urgent Assignee: huwang(a)redhat.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2242803 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2243613 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2234963] New: CVE-2020-21687 nasm: stack-based buffer overflow in stdscan() in stdscan.c [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2234963 Bug ID: 2234963 Summary: CVE-2020-21687 nasm: stack-based buffer overflow in stdscan() in stdscan.c [fedora-all] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2234950 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2234963 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2234962] New: CVE-2020-21686 nasm: stack-use-after-scope in expand_mmac_params() in preproc.c [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2234962 Bug ID: 2234962 Summary: CVE-2020-21686 nasm: stack-use-after-scope in expand_mmac_params() in preproc.c [fedora-all] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2234946 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2234962 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2234961] New: CVE-2020-21685 nasm: buffer overflow in hash_findi() in hashtbl.c [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2234961 Bug ID: 2234961 Summary: CVE-2020-21685 nasm: buffer overflow in hash_findi() in hashtbl.c [fedora-all] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2234944 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2234961 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2234960] New: CVE-2023-38668 nasm: stack-based buffer overflow in disasm() [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2234960 Bug ID: 2234960 Summary: CVE-2023-38668 nasm: stack-based buffer overflow in disasm() [fedora-all] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2234922 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2234960 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2234959] New: CVE-2023-38667 nasm: stack-based buffer overflow in disasm() [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2234959 Bug ID: 2234959 Summary: CVE-2023-38667 nasm: stack-based buffer overflow in disasm() [fedora-all] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2234920 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2234959 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2234958] New: CVE-2023-38665 nasm: NULL pointer dereference in ieee_write_file() [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2234958 Bug ID: 2234958 Summary: CVE-2023-38665 nasm: NULL pointer dereference in ieee_write_file() [fedora-all] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2234917 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2234958 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2234957] New: CVE-2020-21528 nasm: segmentation fault in ieee_segment() in outieee.c [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2234957 Bug ID: 2234957 Summary: CVE-2020-21528 nasm: segmentation fault in ieee_segment() in outieee.c [fedora-all] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2234914 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2234957 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2234956] New: CVE-2020-18780 nasm: use-after-free in new_Token() in asm/preproc.c [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2234956 Bug ID: 2234956 Summary: CVE-2020-18780 nasm: use-after-free in new_Token() in asm/preproc.c [fedora-all] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2234910 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2234956 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2234954] New: CVE-2022-29654 nasm: heap-based buffer overflow in quote_for_pmake() in asm/nasm.c [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2234954 Bug ID: 2234954 Summary: CVE-2022-29654 nasm: heap-based buffer overflow in quote_for_pmake() in asm/nasm.c [fedora-all] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2234903 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2234954 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2234660] New: CVE-2022-44729 CVE-2022-44730 batik: various flaws [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2234660 Bug ID: 2234660 Summary: CVE-2022-44729 CVE-2022-44730 batik: various flaws [fedora-all] Product: Fedora Version: 38 Status: NEW Component: batik Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: mat.booth(a)gmail.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com, mat.booth(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora More information about these security flaws is available in the following bugs: http://bugzilla.redhat.com/show_bug.cgi?id=2233899 http://bugzilla.redhat.com/show_bug.cgi?id=2233889 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2234660 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2231136] New: TRIAGE-CVE-2023-38210 xmpcore: Uncontrolled Resource Consumption [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2231136 Bug ID: 2231136 Summary: TRIAGE-CVE-2023-38210 xmpcore: Uncontrolled Resource Consumption [fedora-all] Product: Fedora Version: 38 Status: NEW Component: xmpcore Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: extras-orphan(a)fedoraproject.org Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2231135 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2231136 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2230047] New: TRIAGE-CVE-2023-34623 jtidy: denial of service via crafted object that uses cyclic dependencies [fedora-38]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2230047 Bug ID: 2230047 Summary: TRIAGE-CVE-2023-34623 jtidy: denial of service via crafted object that uses cyclic dependencies [fedora-38] Product: Fedora Version: 38 Status: NEW Component: jtidy Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: SpikeFedora(a)gmail.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2215234 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2230047 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2227790] New: CVE-2023-20862 log4j: spring-security: Empty SecurityContext Is Not Properly Saved Upon Logout [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2227790 Bug ID: 2227790 Summary: CVE-2023-20862 log4j: spring-security: Empty SecurityContext Is Not Properly Saved Upon Logout [fedora-all] Product: Fedora Version: 38 Status: NEW Component: log4j Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: paul.wouters(a)aiven.io Reporter: ahanwate(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: devrim(a)gunduz.org, italo.garcia+fedora(a)aiven.io, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, rj.layco(a)gmail.com, rominf(a)aiven.io Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2227788 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2227790 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2227076] New: CVE-2022-34169 xalan-j2: OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) [fedora-all]
by bugzilla＠redhat.com 28 May '24

28 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2227076 Bug ID: 2227076 Summary: CVE-2022-34169 xalan-j2: OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407) [fedora-all] Product: Fedora Version: 38 Status: NEW Component: xalan-j2 Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: mizdebsk(a)redhat.com Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: agrimm(a)gmail.com, devrim(a)gunduz.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2108554 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2227076 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2210322] New: CVE-2023-28709 tomcat: Fix for CVE-2023-24998 was incomplete [fedora-all]
by bugzilla＠redhat.com 22 May '24

22 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2210322 Bug ID: 2210322 Summary: CVE-2023-28709 tomcat: Fix for CVE-2023-24998 was incomplete [fedora-all] Product: Fedora Version: 38 Status: NEW Component: tomcat Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: csutherl(a)redhat.com Reporter: pdelbell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2210321 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2210322

1 5

[Bug 2210214] New: CVE-2023-31722 nasm: heap buffer overflow in expand_mmacro() asm/preproc.c [fedora-all]
by bugzilla＠redhat.com 22 May '24

22 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2210214 Bug ID: 2210214 Summary: CVE-2023-31722 nasm: heap buffer overflow in expand_mmacro() asm/preproc.c [fedora-all] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2210211 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2210214

1 3

[Bug 2209388] New: CVE-2023-20883 log4j: spring-boot: Spring Boot Welcome Page DoS Vulnerability [fedora-all]
by bugzilla＠redhat.com 22 May '24

22 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2209388 Bug ID: 2209388 Summary: CVE-2023-20883 log4j: spring-boot: Spring Boot Welcome Page DoS Vulnerability [fedora-all] Product: Fedora Version: 38 Status: NEW Component: log4j Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: paul.wouters(a)aiven.io Reporter: pdelbell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: devrim(a)gunduz.org, italo.garcia+fedora(a)aiven.io, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, rj.layco(a)gmail.com, rominf(a)aiven.io Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2209342 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2209388

1 3

[Bug 2196674] New: CVE-2023-21971 mysql-connector-java: Connector/J unspecified vulnerability (CPU April 2023) [fedora-all]
by bugzilla＠redhat.com 22 May '24

22 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2196674 Bug ID: 2196674 Summary: CVE-2023-21971 mysql-connector-java: Connector/J unspecified vulnerability (CPU April 2023) [fedora-all] Product: Fedora Version: 38 Status: NEW Component: mysql-connector-java Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: zmiklank(a)redhat.com Reporter: mcascell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, ljavorsk(a)redhat.com, mkulik(a)redhat.com, mschorm(a)redhat.com, puntogil(a)libero.it, steve.traylen(a)cern.ch, zmiklank(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2196673 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2196674

1 3

[Bug 2064698] New: CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects
by bugzilla＠redhat.com 22 May '24

22 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2064698 Bug ID: 2064698 Summary: CVE-2020-36518 jackson-databind: denial of service via a large depth of nested objects Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mrehak(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, alazarot(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, ataylor(a)redhat.com, bbaranow(a)redhat.com, bibryam(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, boliveir(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, cdorney(a)redhat.com, cfu(a)redhat.com, chazlett(a)redhat.com, ckelley(a)redhat.com, darran.lofthouse(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, edewata(a)redhat.com, emingora(a)redhat.com, eparis(a)redhat.com, eric.wittmann(a)redhat.com, etirelli(a)redhat.com, fjuma(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, hbraun(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jmagne(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jrokos(a)redhat.com, jross(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, lgao(a)redhat.com, mharmsen(a)redhat.com, mnovotny(a)redhat.com, mosmerov(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, pantinor(a)redhat.com, pdelbell(a)redhat.com, pdrozd(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rhcs-maint(a)redhat.com, rrajasek(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, smaestri(a)redhat.com, sponnaga(a)redhat.com, sthorger(a)redhat.com, swoodman(a)redhat.com, tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com Target Milestone: --- Classification: Other A Java StackOverflow exception and denial of service via a large depth of nested objects. Reference: https://github.com/FasterXML/jackson-databind/issues/2816 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064698

1 62

[Bug 2193303] New: CVE-2022-44368 nasm: null pointer dereference in obj_directive in output/outobj.c [fedora-38]
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2193303 Bug ID: 2193303 Summary: CVE-2022-44368 nasm: null pointer dereference in obj_directive in output/outobj.c [fedora-38] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2193050 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2193303

1 3

[Bug 2193302] New: CVE-2022-44369 nasm: null pointer dereference in aout_add_gotoff_reloc() in output/outaout.c [fedora-38]
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2193302 Bug ID: 2193302 Summary: CVE-2022-44369 nasm: null pointer dereference in aout_add_gotoff_reloc() in output/outaout.c [fedora-38] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2193051 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2193302

1 3

[Bug 2160814] New: CVE-2022-46456 nasm: buffer overflow in dbgdbg_typevalue() in output/outdbg.c [fedora-all]
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2160814 Bug ID: 2160814 Summary: CVE-2022-46456 nasm: buffer overflow in dbgdbg_typevalue() in output/outdbg.c [fedora-all] Product: Fedora Version: 37 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2160807 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2160814

1 6

[Bug 2133075] New: CVE-2022-41420 nasm: stack-based buffer overflow in the ndisasm component
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2133075 Bug ID: 2133075 Summary: CVE-2022-41420 nasm: stack-based buffer overflow in the ndisasm component Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, nickc(a)redhat.com, pbonzini(a)redhat.com, sipoyare(a)redhat.com Target Milestone: --- Classification: Other nasm v2.16 was discovered to contain a stack overflow in the Ndisasm component. Reference: https://bugzilla.nasm.us/show_bug.cgi?id=3392810 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2133075

1 7

[Bug 2133076] New: CVE-2022-41420 nasm: stack-based buffer overflow in the ndisasm component [fedora-all]
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2133076 Bug ID: 2133076 Summary: CVE-2022-41420 nasm: stack-based buffer overflow in the ndisasm component [fedora-all] Product: Fedora Version: 36 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2133076

1 4

[Bug 2123082] New: CVE-2021-33452 nasm: memory leak in nasm_malloc() in nasmlib/alloc.c
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2123082 Bug ID: 2123082 Summary: CVE-2021-33452 nasm: memory leak in nasm_malloc() in nasmlib/alloc.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, nickc(a)redhat.com, pbonzini(a)redhat.com, sipoyare(a)redhat.com Target Milestone: --- Classification: Other An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_malloc() in nasmlib/alloc.c. Reference: https://bugzilla.nasm.us/show_bug.cgi?id=3392757 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2123082

1 5

[Bug 2123083] New: CVE-2021-33452 nasm: memory leak in nasm_malloc() in nasmlib/alloc.c [fedora-all]
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2123083 Bug ID: 2123083 Summary: CVE-2021-33452 nasm: memory leak in nasm_malloc() in nasmlib/alloc.c [fedora-all] Product: Fedora Version: 36 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2123083

1 4

[Bug 2123079] New: CVE-2021-33450 nasm: memory leak in nasm_calloc() in nasmlib/alloc.c
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2123079 Bug ID: 2123079 Summary: CVE-2021-33450 nasm: memory leak in nasm_calloc() in nasmlib/alloc.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, nickc(a)redhat.com, pbonzini(a)redhat.com, sipoyare(a)redhat.com Target Milestone: --- Classification: Other An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c. Reference: https://bugzilla.nasm.us/show_bug.cgi?id=3392758 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2123079

1 5

[Bug 2123080] New: CVE-2021-33450 nasm: memory leak in nasm_calloc() in nasmlib/alloc.c [fedora-all]
by bugzilla＠redhat.com 21 May '24

21 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2123080 Bug ID: 2123080 Summary: CVE-2021-33450 nasm: memory leak in nasm_calloc() in nasmlib/alloc.c [fedora-all] Product: Fedora Version: 36 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2123080

1 4

[Bug 2231574] New: jdependency-2.9.0 is available
by bugzilla＠redhat.com 17 May '24

17 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2231574 Bug ID: 2231574 Summary: jdependency-2.9.0 is available Product: Fedora Version: rawhide Status: NEW Component: jdependency Keywords: FutureFeature, Triaged Assignee: sergio(a)serjux.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, sergio(a)serjux.com Target Milestone: --- Classification: Fedora Releases retrieved: 2.9.0 Upstream release that is considered latest: 2.9.0 Current version/release in rawhide: 2.8.0-4.fc39 URL: https://github.com/tcurdt/jdependency Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1435/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/jdependency -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2231574 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 6

[Bug 2193296] New: CVE-2022-44370 nasm: heap buffer overflow in quote_for_pmake() in asm/nasm.c [fedora-37]
by bugzilla＠redhat.com 08 May '24

08 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2193296 Bug ID: 2193296 Summary: CVE-2022-44370 nasm: heap buffer overflow in quote_for_pmake() in asm/nasm.c [fedora-37] Product: Fedora Version: 37 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2193052 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2193296

1 6

[Bug 2098590] New: nasm: heap buffer overflow in quote_for_pmake() in asm/nasm.c
by bugzilla＠redhat.com 08 May '24

08 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2098590 Bug ID: 2098590 Summary: nasm: heap buffer overflow in quote_for_pmake() in asm/nasm.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: trathi(a)redhat.com CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Other A heap buffer overflow flaw was found in quote_for_pmake() in asm/nasm.c. https://bugzilla.nasm.us/show_bug.cgi?id=3392799 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2098590

1 10

[Bug 2193297] New: CVE-2022-44370 nasm: heap buffer overflow in quote_for_pmake() in asm/nasm.c [fedora-38]
by bugzilla＠redhat.com 08 May '24

08 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2193297 Bug ID: 2193297 Summary: CVE-2022-44370 nasm: heap buffer overflow in quote_for_pmake() in asm/nasm.c [fedora-38] Product: Fedora Version: 38 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2193052 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2193297

1 4

[Bug 2098593] New: nasm: heap buffer overflow in quote_for_pmake() in asm/nasm.c [fedora-all]
by bugzilla＠redhat.com 08 May '24

08 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2098593 Bug ID: 2098593 Summary: nasm: heap buffer overflow in quote_for_pmake() in asm/nasm.c [fedora-all] Product: Fedora Version: 36 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2098593

1 5

[Bug 2095426] New: [RFE] jetty use systemd-sysusers
by bugzilla＠redhat.com 07 May '24

07 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2095426 Bug ID: 2095426 Summary: [RFE] jetty use systemd-sysusers Product: Fedora Version: 36 Status: NEW Component: jetty Assignee: mat.booth(a)gmail.com Reporter: riehecky(a)fnal.gov QA Contact: extras-qa(a)fedoraproject.org CC: eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jjohnstn(a)redhat.com, krzysztof.daniel(a)gmail.com, mat.booth(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Description of problem: jetty is using static user add scripts Version-Release number of selected component (if applicable): jetty-9.4.38-2 How reproducible: 100% Steps to Reproduce: 1.review %pre 2. 3. Actual results: %pre # Add the "jetty" user and group getent group %username >/dev/null || groupadd -f -g %jtuid -r %username if ! getent passwd %username >/dev/null ; then if ! getent passwd %jtuid >/dev/null ; then useradd -r -u %jtuid -g %username -d %homedir -s /sbin/nologin \ -c "Jetty web server" %username else useradd -r -g %username -d %homedir -s /sbin/nologin \ -c "Jetty web server" %username fi fi exit 0 Expected results: use of system-sysusers Additional info: https://www.freedesktop.org/software/systemd/man/systemd-sysusers.html https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095426

1 2

[Bug 2095423] New: [RFE] hsqldb use systemd-sysusers
by bugzilla＠redhat.com 07 May '24

07 May '24

https://bugzilla.redhat.com/show_bug.cgi?id=2095423 Bug ID: 2095423 Summary: [RFE] hsqldb use systemd-sysusers Product: Fedora Version: 36 Status: NEW Component: hsqldb1 Assignee: extras-orphan(a)fedoraproject.org Reporter: riehecky(a)fnal.gov QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Description of problem: hsqldb is using static useradd scripts Version-Release number of selected component (if applicable): hsqldb-2.4.0-12 How reproducible: 100% Steps to Reproduce: 1.review %pre 2. 3. Actual results: %pre # Add the "hsqldb" user and group # we need a shell to be able to use su - later %{_sbindir}/groupadd -g 96 -f -r %{name} 2> /dev/null || : %{_sbindir}/useradd -u 96 -g %{name} -s /sbin/nologin \ -d %{_localstatedir}/lib/%{name} -r %{name} 2> /dev/null || : Expected results: use of system-sysusers Additional info: https://www.freedesktop.org/software/systemd/man/systemd-sysusers.html https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2095423

1 2

[Bug 2035087] New: CVE-2021-45257 nasm: Infinite loop via the gpaste_tokens function
by bugzilla＠redhat.com 08 Apr '24

08 Apr '24

https://bugzilla.redhat.com/show_bug.cgi?id=2035087 Bug ID: 2035087 Summary: CVE-2021-45257 nasm: Infinite loop via the gpaste_tokens function Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, nickc(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Other An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function. References: https://bugzilla.nasm.us/show_bug.cgi?id=3392790 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2035087

1 11

[Bug 2035088] New: CVE-2021-45257 nasm: Infinite loop via the gpaste_tokens function [fedora-all]
by bugzilla＠redhat.com 08 Apr '24

08 Apr '24

https://bugzilla.redhat.com/show_bug.cgi?id=2035088 Bug ID: 2035088 Summary: CVE-2021-45257 nasm: Infinite loop via the gpaste_tokens function [fedora-all] Product: Fedora Version: 35 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2035088

1 6

[Bug 2035084] New: CVE-2021-45256 nasm: Null pointer dereference via asm/preproc.c
by bugzilla＠redhat.com 08 Apr '24

08 Apr '24

https://bugzilla.redhat.com/show_bug.cgi?id=2035084 Bug ID: 2035084 Summary: CVE-2021-45256 nasm: Null pointer dereference via asm/preproc.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, nickc(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Other A Null Pointer Dereference vulnerability existfs in nasm 2.16rc0 via asm/preproc.c. References: https://bugzilla.nasm.us/show_bug.cgi?id=3392789 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2035084

1 10

[Bug 2035086] New: CVE-2021-45256 nasm: Null pointer dereference via asm/preproc.c [fedora-all]
by bugzilla＠redhat.com 08 Apr '24

08 Apr '24

https://bugzilla.redhat.com/show_bug.cgi?id=2035086 Bug ID: 2035086 Summary: CVE-2021-45256 nasm: Null pointer dereference via asm/preproc.c [fedora-all] Product: Fedora Version: 35 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2035086

1 6

[Bug 2134292] New: CVE-2022-40151 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks
by bugzilla＠redhat.com 18 Mar '24

18 Mar '24

https://bugzilla.redhat.com/show_bug.cgi?id=2134292 Bug ID: 2134292 Summary: CVE-2022-40151 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: pdelbell(a)redhat.com CC: didiksupriadi41(a)gmail.com, fedoraproject.org(a)bluhm-de.com, java-sig-commits(a)lists.fedoraproject.org, lkundrak(a)v3.sk, mizdebsk(a)redhat.com Blocks: 2128414 Target Milestone: --- Classification: Other Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. https://github.com/x-stream/xstream/issues/304 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47367 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2134292

1 17

[Bug 2252668] New: javaparser-3.25.7 is available
by bugzilla＠redhat.com 21 Feb '24

21 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2252668 Bug ID: 2252668 Summary: javaparser-3.25.7 is available Product: Fedora Version: rawhide Status: NEW Component: javaparser Keywords: FutureFeature, Triaged Assignee: markku.korkeala(a)kapsi.fi Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, markku.korkeala(a)kapsi.fi, mharmsen(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Releases retrieved: 3.25.7 Upstream release that is considered latest: 3.25.7 Current version/release in rawhide: 3.25.6-1.fc40 URL: https://javaparser.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/89330/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/javaparser -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2252668 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2019329] New: nosync.so is linked against GLIBC_2.34 symbols, it breaks mock
by bugzilla＠redhat.com 16 Feb '24

16 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2019329 Bug ID: 2019329 Summary: nosync.so is linked against GLIBC_2.34 symbols, it breaks mock Product: Fedora Version: 35 Status: NEW Component: nosync Assignee: mizdebsk(a)redhat.com Reporter: praiskup(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora I'm not sure what changed, but the new dependency is breaking Mock builds for older distributions (e.g. even Fedora 34 doesn't provide 2.34 symbols). $ cat ~/.config/mock.cfg | grep nosync config_opts['nosync'] = True $ mock -r fedora-34-x86_64 --shell ... Running scriptlet: ca-certificates-2021.2.50-1.0.fc34.noarch 83/134 /bin/sh: /lib64/libc.so.6: version `GLIBC_2.34' not found (required by /var/tmp/tmp.mock.khvcffv5/lib64/nosync.so) error: %prein(ca-certificates-2021.2.50-1.0.fc34.noarch) scriptlet failed, exit status 1 Error in PREIN scriptlet in rpm package ca-certificates Installing : krb5-libs-1.19.2-2.fc34.x86_64 84/134 error: ca-certificates-2021.2.50-1.0.fc34.noarch: install failed ... Failed: ca-certificates-2021.2.50-1.0.fc34.noarch tpm2-tss-3.1.0-1.fc34.x86_64 Error: Transaction failed -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2019329

1 27

[Bug 2066479] New: maven-shared-utils: Command injection via Commandline class
by bugzilla＠redhat.com 12 Feb '24

12 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2066479 Bug ID: 2066479 Summary: maven-shared-utils: Command injection via Commandline class Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aileenc(a)redhat.com, asoldano(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, fjansen(a)redhat.com, fjuma(a)redhat.com, ggastald(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, hhorak(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jochrist(a)redhat.com, jorton(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, lgao(a)redhat.com, mizdebsk(a)redhat.com, mosmerov(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, nwallace(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, sbiarozk(a)redhat.com, smaestri(a)redhat.com, tom.jenkinson(a)redhat.com Target Milestone: --- Classification: Other org.apache.maven.shared:maven-shared-utils is a functional replacement for plexus-utils in Maven. Affected versions of this package are vulnerable to Command Injection. The Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks. The BourneShell class should unconditionally single-quote emitted strings (including the name of the command itself being quoted), with {{'"'"'}} used for embedded single quotes, for maximum safety across shells implementing a superset of POSIX quoting rules. References: https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHEMAVENSHARED-570592 https://issues.apache.org/jira/browse/MSHARED-297 https://github.com/apache/maven-shared-utils/pull/40 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2066479

1 62

[Bug 2126789] New: CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections.
by bugzilla＠redhat.com 12 Feb '24

12 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2126789 Bug ID: 2126789 Summary: CVE-2022-25857 snakeyaml: Denial of Service due missing to nested depth limitation for collections. Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: pdelbell(a)redhat.com CC: fedoraproject.org(a)bluhm-de.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, mizdebsk(a)redhat.com, mo(a)morsi.org Target Milestone: --- Classification: Other The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2126789

1 81

[Bug 1955739] New: CVE-2021-26291 maven: Block repositories using http by default
by bugzilla＠redhat.com 12 Feb '24

12 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=1955739 Bug ID: 1955739 Summary: CVE-2021-26291 maven: Block repositories using http by default Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, eleandro(a)redhat.com, etirelli(a)redhat.com, fjuma(a)redhat.com, gvarsami(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, java-maint-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jochrist(a)redhat.com, jperkins(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, mizdebsk(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msrb(a)redhat.com, msvehla(a)redhat.com, nwallace(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, rguimara(a)redhat.com, rrajasek(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rwagner(a)redhat.com, smaestri(a)redhat.com, sochotni(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, tzimanyi(a)redhat.com, yborgess(a)redhat.com Target Milestone: --- Classification: Other Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. References: https://lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fd… https://lists.apache.org/thread.html/r06db4057b74e0598a412734f693a34a8836ac… https://lists.apache.org/thread.html/r9a027668558264c4897633e66bcb7784099fd… http://www.openwall.com/lists/oss-security/2021/04/23/5 https://lists.apache.org/thread.html/r0556ce5db7231025785477739ee416b169d8a… https://lists.apache.org/thread.html/ra88a0eba7f84658cefcecc0143fd8bbad52c2… https://lists.apache.org/thread.html/r3f0450dcab7e63b5f233ccfbc6fca5f1867a7… -- You are receiving this mail because: You are on the CC list for the bug.

1 32

[Bug 2255774] New: plexus-containers-2.2.0 is available
by bugzilla＠redhat.com 11 Feb '24

11 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2255774 Bug ID: 2255774 Summary: plexus-containers-2.2.0 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-containers Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 2.2.0 Upstream release that is considered latest: 2.2.0 Current version/release in rawhide: 2.1.1-7.fc40 URL: https://github.com/codehaus-plexus/plexus-containers Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/3668/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/plexus-containers -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2255774 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 8

[Bug 2251796] New: janino-3.1.11 is available
by bugzilla＠redhat.com 06 Feb '24

06 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2251796 Bug ID: 2251796 Summary: janino-3.1.11 is available Product: Fedora Version: rawhide Status: NEW Component: janino Keywords: FutureFeature, Triaged Assignee: didiksupriadi41(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: didiksupriadi41(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Releases retrieved: 3.1.11 Upstream release that is considered latest: 3.1.11 Current version/release in rawhide: 3.1.10-1.fc39 URL: https://janino-compiler.github.io/janino/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/89329/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/janino -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2251796 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 5

[Bug 2193301] New: CVE-2022-44368 nasm: null pointer dereference in obj_directive in output/outobj.c [fedora-37]
by bugzilla＠redhat.com 05 Feb '24

05 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2193301 Bug ID: 2193301 Summary: CVE-2022-44368 nasm: null pointer dereference in obj_directive in output/outobj.c [fedora-37] Product: Fedora Version: 37 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2193050 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2193301

1 5

[Bug 2193300] New: CVE-2022-44369 nasm: null pointer dereference in aout_add_gotoff_reloc() in output/outaout.c [fedora-37]
by bugzilla＠redhat.com 05 Feb '24

05 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2193300 Bug ID: 2193300 Summary: CVE-2022-44369 nasm: null pointer dereference in aout_add_gotoff_reloc() in output/outaout.c [fedora-37] Product: Fedora Version: 37 Status: NEW Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: dominik(a)greysector.net Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dominik(a)greysector.net, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, pbonzini(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2193051 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2193300

1 5

[Bug 2193226] New: xalan-j2-2.7.3 is available
by bugzilla＠redhat.com 04 Feb '24

04 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2193226 Bug ID: 2193226 Summary: xalan-j2-2.7.3 is available Product: Fedora Version: rawhide Status: NEW Component: xalan-j2 Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: agrimm(a)gmail.com, devrim(a)gunduz.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 2.7.3 Upstream release that is considered latest: 2.7.3 Current version/release in rawhide: 2.7.2-14.fc38 URL: http://xalan.apache.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/20401/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/xalan-j2 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2193226

1 5

[Bug 2251020] New: jctools-4.0.2 is available
by bugzilla＠redhat.com 02 Feb '24

02 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2251020 Bug ID: 2251020 Summary: jctools-4.0.2 is available Product: Fedora Version: rawhide Status: NEW Component: jctools Keywords: FutureFeature, Triaged Assignee: paul.wouters(a)aiven.io Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Releases retrieved: 4.0.2 Upstream release that is considered latest: 4.0.2 Current version/release in rawhide: 4.0.1-4.fc40 URL: https://github.com/JCTools/JCTools Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/89333/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/jctools -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2251020 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 6

[Bug 1801149] New: CVE-2019-13990 libquartz-java: XXE attacks via job description
by bugzilla＠redhat.com 02 Feb '24

02 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=1801149 Bug ID: 1801149 Summary: CVE-2019-13990 libquartz-java: XXE attacks via job description Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: agrimm(a)gmail.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bkearney(a)redhat.com, btotty(a)redhat.com, chazlett(a)redhat.com, dblechte(a)redhat.com, dfediuck(a)redhat.com, drieden(a)redhat.com, eedri(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gvarsami(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jochrist(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lef(a)fedoraproject.org, lzap(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pjindal(a)redhat.com, puntogil(a)libero.it, rchan(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbonazzo(a)redhat.com, sdaley(a)redhat.com, sherold(a)redhat.com, sokeeffe(a)redhat.com, tbrisker(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, yturgema(a)redhat.com Target Milestone: --- Classification: Other A vulnerability was found in initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. Reference: https://github.com/quartz-scheduler/quartz/issues/467 https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af9… https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1… https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de… https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e8… https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a390… -- You are receiving this mail because: You are on the CC list for the bug.

1 27

[Bug 2245359] New: jsoup-1.16.2 is available
by bugzilla＠redhat.com 01 Feb '24

01 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2245359 Bug ID: 2245359 Summary: jsoup-1.16.2 is available Product: Fedora Version: rawhide Status: NEW Component: jsoup Keywords: FutureFeature, Triaged Assignee: extras-orphan(a)fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, mkoncek(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 1.16.2 Upstream release that is considered latest: 1.16.2 Current version/release in rawhide: 1.16.1-2.fc40 URL: https://jsoup.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1479/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/jsoup -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2245359 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 6

[Bug 2245742] New: maven-dependency-plugin-3.6.1 is available
by bugzilla＠redhat.com 01 Feb '24

01 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2245742 Bug ID: 2245742 Summary: maven-dependency-plugin-3.6.1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-dependency-plugin Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.6.1 Upstream release that is considered latest: 3.6.1 Current version/release in rawhide: 3.6.0-2.fc40 URL: http://maven.apache.org/plugins/maven-dependency-plugin/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1902/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/maven-dependency-plugin -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2245742 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2238239] New: maven-enforcer-3.4.1 is available
by bugzilla＠redhat.com 01 Feb '24

01 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2238239 Bug ID: 2238239 Summary: maven-enforcer-3.4.1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-enforcer Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.4.1 Upstream release that is considered latest: 3.4.1 Current version/release in rawhide: 3.4.0-2.fc40 URL: http://maven.apache.org/enforcer/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1909/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/maven-enforcer -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2238239 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2242758] New: mojo-parent-77 is available
by bugzilla＠redhat.com 01 Feb '24

01 Feb '24

https://bugzilla.redhat.com/show_bug.cgi?id=2242758 Bug ID: 2242758 Summary: mojo-parent-77 is available Product: Fedora Version: rawhide Status: NEW Component: mojo-parent Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 77 Upstream release that is considered latest: 77 Current version/release in rawhide: 76-2.fc40 URL: http://www.mojohaus.org/mojo-parent/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/2005/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/mojo-parent -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2242758 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 5

[Bug 2245491] New: plexus-cipher-2.1.0 is available
by bugzilla＠redhat.com 31 Jan '24

31 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2245491 Bug ID: 2245491 Summary: plexus-cipher-2.1.0 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-cipher Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 2.1.0 Upstream release that is considered latest: 2.1.0 Current version/release in rawhide: 2.0-7.fc40 URL: https://github.com/codehaus-plexus/plexus-cipher Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/3657/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/plexus-cipher -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2245491 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 2

[Bug 2171439] New: apache-commons-net: FTBFS in Fedora rawhide/f38
by bugzilla＠redhat.com 31 Jan '24

31 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2171439 Bug ID: 2171439 Summary: apache-commons-net: FTBFS in Fedora rawhide/f38 Product: Fedora Version: rawhide Status: NEW Component: apache-commons-net Assignee: luis(a)blackfile.net Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, luis(a)blackfile.net, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com Blocks: 2117176 (F38FTBFS) Target Milestone: --- Classification: Fedora apache-commons-net failed to build from source in Fedora rawhide/f38 https://koji.fedoraproject.org/koji/taskinfo?taskID=96310506 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Please fix apache-commons-net at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, apache-commons-net will be orphaned. Before branching of Fedora 39, apache-commons-net will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails… Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2117176 [Bug 2117176] Fedora 38 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2171439

1 2

[Bug 2252980] New: F40FailsToInstall: apache-commons-modeler
by bugzilla＠redhat.com 31 Jan '24

31 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2252980 Bug ID: 2252980 Summary: F40FailsToInstall: apache-commons-modeler Product: Fedora Version: rawhide Status: NEW Component: apache-commons-modeler Assignee: SpikeFedora(a)gmail.com Reporter: fti-bugs(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com Blocks: 2231790 (F40FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically by https://pagure.io/releng/blob/main/f/scripts/ftbfs-fti/follow-policy.py If you feel that this output has mistakes, please open an issue at https://pagure.io/releng/ Your package (apache-commons-modeler) Fails To Install in Fedora 40: can't install apache-commons-modeler: - nothing provides mvn(commons-logging:commons-logging-api) needed by apache-commons-modeler-2.0.1-36.fc39.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails…) your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. To reproduce, use the koji/local repo only, e.g. in mock: $ mock -r fedora-40-x86_64 --config-opts mirrored=False install apache-commons-modeler P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter-d… Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2231790 [Bug 2231790] Fedora 40 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2252980 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 7

[Bug 2171438] New: apache-commons-lang3: FTBFS in Fedora rawhide/f38
by bugzilla＠redhat.com 31 Jan '24

31 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2171438 Bug ID: 2171438 Summary: apache-commons-lang3: FTBFS in Fedora rawhide/f38 Product: Fedora Version: rawhide Status: NEW Component: apache-commons-lang3 Assignee: stuart(a)gathman.org Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, stuart(a)gathman.org Blocks: 2117176 (F38FTBFS) Target Milestone: --- Classification: Fedora apache-commons-lang3 failed to build from source in Fedora rawhide/f38 https://koji.fedoraproject.org/koji/taskinfo?taskID=96310469 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Please fix apache-commons-lang3 at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, apache-commons-lang3 will be orphaned. Before branching of Fedora 39, apache-commons-lang3 will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fails… Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2117176 [Bug 2117176] Fedora 38 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2171438

1 1

[Bug 1694308] New: httpcomponents-client-4.5.8 is available
by bugzilla＠redhat.com 31 Jan '24

31 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=1694308 Bug ID: 1694308 Summary: httpcomponents-client-4.5.8 is available Product: Fedora Version: rawhide Status: NEW Component: httpcomponents-client Keywords: FutureFeature, Triaged Assignee: stuart(a)gathman.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com, sochotni(a)redhat.com, stuart(a)gathman.org Target Milestone: --- Classification: Fedora Latest upstream release: 4.5.8 Current version/release in rawhide: 4.5.6-3.fc30 URL: http://www.apache.org/dist/httpcomponents/httpclient/source/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1334/ -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 2244348] New: Wrong dbcp class in tomcat 9
by bugzilla＠redhat.com 22 Jan '24

22 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2244348 Bug ID: 2244348 Summary: Wrong dbcp class in tomcat 9 Product: Fedora Version: 37 OS: Linux Status: NEW Component: tomcat Severity: medium Assignee: huwang(a)redhat.com Reporter: huwang(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora File tomcat.conf contains: JAVA_OPTS="-Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory" It should be: JAVA_OPTS="-Djavax.sql.DataSource.Factory=org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory" The dbcp class does not exist in TC 9, which switch to dbcp2. Reproducible: Always -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2244348 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 2

[Bug 2242516] New: CVE-2023-37460 plexus-archiver: Arbitrary File Creation in AbstractUnArchiver [fedora-37]
by bugzilla＠redhat.com 22 Jan '24

22 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2242516 Bug ID: 2242516 Summary: CVE-2023-37460 plexus-archiver: Arbitrary File Creation in AbstractUnArchiver [fedora-37] Product: Fedora Version: 37 Status: NEW Component: plexus-archiver Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: mizdebsk(a)redhat.com Reporter: ntait(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2242288 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2242516 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2230046] New: TRIAGE-CVE-2023-34623 jtidy: denial of service via crafted object that uses cyclic dependencies [fedora-37]
by bugzilla＠redhat.com 15 Jan '24

15 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2230046 Bug ID: 2230046 Summary: TRIAGE-CVE-2023-34623 jtidy: denial of service via crafted object that uses cyclic dependencies [fedora-37] Product: Fedora Version: 37 Status: NEW Component: jtidy Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: SpikeFedora(a)gmail.com Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2215234 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2230046 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2216893] New: TRIAGE-CVE-2023-34462 log4j: netty: io.netty:netty-handler: SniHandler 16MB allocation [fedora-37]
by bugzilla＠redhat.com 15 Jan '24

15 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2216893 Bug ID: 2216893 Summary: TRIAGE-CVE-2023-34462 log4j: netty: io.netty:netty-handler: SniHandler 16MB allocation [fedora-37] Product: Fedora Version: 37 Status: NEW Component: log4j Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: paul.wouters(a)aiven.io Reporter: trathi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: devrim(a)gunduz.org, italo.garcia+fedora(a)aiven.io, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, rj.layco(a)gmail.com, rominf(a)aiven.io Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2216888 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2216893 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2185305] New: CVE-2022-4065 testng: a path traversal in zip files [fedora-all]
by bugzilla＠redhat.com 15 Jan '24

15 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2185305 Bug ID: 2185305 Summary: CVE-2022-4065 testng: a path traversal in zip files [fedora-all] Product: Fedora Version: 37 Status: NEW Component: testng Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: mizdebsk(a)redhat.com Reporter: chazlett(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, lkundrak(a)v3.sk, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2185304 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2185305

1 4

[Bug 2182793] New: log4j: jettison: Uncontrolled Recursion in JSONArray [fedora-all]
by bugzilla＠redhat.com 15 Jan '24

15 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2182793 Bug ID: 2182793 Summary: log4j: jettison: Uncontrolled Recursion in JSONArray [fedora-all] Product: Fedora Version: 37 Status: NEW Component: log4j Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: paul.wouters(a)aiven.io Reporter: pdelbell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, devrim(a)gunduz.org, italo.garcia+fedora(a)aiven.io, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, rj.layco(a)gmail.com, rominf(a)aiven.io Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2182788 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2182793

1 4

[Bug 2180533] New: CVE-2023-20861 log4j: springframework: Spring Expression DoS Vulnerability [fedora-all]
by bugzilla＠redhat.com 12 Jan '24

12 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2180533 Bug ID: 2180533 Summary: CVE-2023-20861 log4j: springframework: Spring Expression DoS Vulnerability [fedora-all] Product: Fedora Version: 37 Status: NEW Component: log4j Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: paul.wouters(a)aiven.io Reporter: pdelbell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, devrim(a)gunduz.org, italo.garcia+fedora(a)aiven.io, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, rj.layco(a)gmail.com, rominf(a)aiven.io Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2180530 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2180533

1 4

[Bug 2180531] New: CVE-2023-20860 log4j: springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern [fedora-all]
by bugzilla＠redhat.com 12 Jan '24

12 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2180531 Bug ID: 2180531 Summary: CVE-2023-20860 log4j: springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern [fedora-all] Product: Fedora Version: 37 Status: NEW Component: log4j Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: paul.wouters(a)aiven.io Reporter: pdelbell(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, devrim(a)gunduz.org, italo.garcia+fedora(a)aiven.io, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, rj.layco(a)gmail.com, rominf(a)aiven.io Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2180528 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2180531

1 4

[Bug 2178890] New: CVE-2022-31692 log4j: spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security [fedora-37]
by bugzilla＠redhat.com 12 Jan '24

12 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2178890 Bug ID: 2178890 Summary: CVE-2022-31692 log4j: spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security [fedora-37] Product: Fedora Version: 37 Status: NEW Component: log4j Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: paul.wouters(a)aiven.io Reporter: ahanwate(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, devrim(a)gunduz.org, italo.garcia+fedora(a)aiven.io, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, paul.wouters(a)aiven.io, rj.layco(a)gmail.com, rominf(a)aiven.io Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2162206 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2178890

1 4

[Bug 2173753] New: CVE-2023-24998 apache-commons-fileupload: Apache Commons FileUpload: FileUpload DoS with excessive parts [fedora-all]
by bugzilla＠redhat.com 12 Jan '24

12 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2173753 Bug ID: 2173753 Summary: CVE-2023-24998 apache-commons-fileupload: Apache Commons FileUpload: FileUpload DoS with excessive parts [fedora-all] Product: Fedora Version: 37 Status: NEW Component: apache-commons-fileupload Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: jjelen(a)redhat.com Reporter: chazlett(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, jjelen(a)redhat.com, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com Target Milestone: --- Classification: Fedora More information about this security flaw is available in the following bug: http://bugzilla.redhat.com/show_bug.cgi?id=2172298 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2173753

1 5

[Bug 2137238] New: lucene-9.4.1 is available
by bugzilla＠redhat.com 11 Jan '24

11 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2137238 Bug ID: 2137238 Summary: lucene-9.4.1 is available Product: Fedora Version: rawhide Status: NEW Component: lucene Keywords: FutureFeature, Triaged Assignee: mkoncek(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, dchen(a)redhat.com, eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com, mkoncek(a)redhat.com, rgrunber(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 9.4.1 Upstream release that is considered latest: 9.4.1 Current version/release in rawhide: 9.4.0-1.fc38 URL: http://lucene.apache.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/7178/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/lucene -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2137238

1 14

[Bug 2254471] New: plantuml-1.2023.13 is available
by bugzilla＠redhat.com 04 Jan '24

04 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2254471 Bug ID: 2254471 Summary: plantuml-1.2023.13 is available Product: Fedora Version: rawhide Status: NEW Component: plantuml Keywords: FutureFeature, Triaged Assignee: h-k-81(a)hotmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: blaise(a)gmail.com, h-k-81(a)hotmail.com, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it, sumitgarg44(a)gmail.com Target Milestone: --- Classification: Fedora Releases retrieved: 1.2023.13 Upstream release that is considered latest: 1.2023.13 Current version/release in rawhide: 1.2023.12-1.fc40 URL: http://plantuml.com/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/17819/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/plantuml -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2254471 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 1978762] New: slf4j-2.0.0-alpha2 is available
by bugzilla＠redhat.com 04 Jan '24

04 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=1978762 Bug ID: 1978762 Summary: slf4j-2.0.0-alpha2 is available Product: Fedora Version: rawhide Status: NEW Component: slf4j Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: alexander.m.scheel(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jmagne(a)redhat.com, mizdebsk(a)redhat.com, mkdineshprasanth(a)gmail.com Target Milestone: --- Classification: Fedora Latest upstream release: 2.0.0-alpha2 Current version/release in rawhide: 1.7.30-9.fc35 URL: http://www.slf4j.org/download.html Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/4831/ -- You are receiving this mail because: You are on the CC list for the bug.

1 19

[Bug 2250209] New: exec-maven-plugin-3.1.1 is available
by bugzilla＠redhat.com 03 Jan '24

03 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2250209 Bug ID: 2250209 Summary: exec-maven-plugin-3.1.1 is available Product: Fedora Version: rawhide Status: NEW Component: exec-maven-plugin Keywords: FutureFeature, Triaged Assignee: deamicis(a)bluewin.ch Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: deamicis(a)bluewin.ch, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.1.1 Upstream release that is considered latest: 3.1.1 Current version/release in rawhide: 3.1.0-3.fc39 URL: https://www.mojohaus.org/exec-maven-plugin/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/772/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/exec-maven-plugin -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2250209 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 1

[Bug 2240493] New: maven-shade-plugin-3.5.1 is available
by bugzilla＠redhat.com 03 Jan '24

03 Jan '24

https://bugzilla.redhat.com/show_bug.cgi?id=2240493 Bug ID: 2240493 Summary: maven-shade-plugin-3.5.1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-shade-plugin Keywords: FutureFeature, Triaged Assignee: deamicis(a)bluewin.ch Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: deamicis(a)bluewin.ch, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.5.1 Upstream release that is considered latest: 3.5.1 Current version/release in rawhide: 3.5.0-2.fc39 URL: http://maven.apache.org/plugins/maven-shade-plugin/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1936/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/maven-shade-plugin -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2240493 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 1

[Bug 2242296] New: apache-commons-net-3.10.0 is available
by bugzilla＠redhat.com 22 Dec '23

22 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2242296 Bug ID: 2242296 Summary: apache-commons-net-3.10.0 is available Product: Fedora Version: rawhide Status: NEW Component: apache-commons-net Keywords: FutureFeature, Triaged Assignee: luis(a)blackfile.net Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, luis(a)blackfile.net, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.10.0 Upstream release that is considered latest: 3.10.0 Current version/release in rawhide: 3.9.0-2.fc40 URL: http://www.apache.org/dist/commons/net/source/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/81/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/apache-commons-net -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2242296 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2250982] New: apache-commons-lang3-3.14.0 is available
by bugzilla＠redhat.com 22 Dec '23

22 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2250982 Bug ID: 2250982 Summary: apache-commons-lang3-3.14.0 is available Product: Fedora Version: rawhide Status: NEW Component: apache-commons-lang3 Keywords: FutureFeature, Triaged Assignee: stuart(a)gathman.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, stuart(a)gathman.org Target Milestone: --- Classification: Fedora Releases retrieved: 3.14.0 Upstream release that is considered latest: 3.14.0 Current version/release in rawhide: 3.13.0-3.fc40 URL: http://archive.apache.org/dist/commons/lang/source/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/76/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/apache-commons-lang3 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2250982 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2254527] New: plexus-compiler-2.14.1 is available
by bugzilla＠redhat.com 21 Dec '23

21 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2254527 Bug ID: 2254527 Summary: plexus-compiler-2.14.1 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-compiler Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 2.14.0, 2.14.1 Upstream release that is considered latest: 2.14.1 Current version/release in rawhide: 2.13.0-2.fc40 URL: https://github.com/codehaus-plexus/plexus-compiler Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/9003/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/plexus-compiler -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2254527 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2244538] New: xbean-4.24 is available
by bugzilla＠redhat.com 21 Dec '23

21 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2244538 Bug ID: 2244538 Summary: xbean-4.24 is available Product: Fedora Version: rawhide Status: NEW Component: xbean Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 4.24 Upstream release that is considered latest: 4.24 Current version/release in rawhide: 4.23-2.fc40 URL: https://geronimo.apache.org/xbean/index.html Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/5162/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/xbean -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2244538 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2241931] New: plexus-pom-15 is available
by bugzilla＠redhat.com 21 Dec '23

21 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2241931 Bug ID: 2241931 Summary: plexus-pom-15 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-pom Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Releases retrieved: 15 Upstream release that is considered latest: 15 Current version/release in rawhide: 14-2.fc40 URL: https://github.com/codehaus-plexus/plexus-pom Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/20412/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/plexus-pom -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2241931 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2242488] New: icu4j-74-rc is available
by bugzilla＠redhat.com 15 Dec '23

15 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2242488 Bug ID: 2242488 Summary: icu4j-74-rc is available Product: Fedora Version: rawhide Status: NEW Component: icu4j Keywords: FutureFeature, Triaged Assignee: loganjerry(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: fnasser(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, loganjerry(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: brs/2023-10-04, 74-rc Upstream release that is considered latest: 74-rc Current version/release in rawhide: 73.2-2.fc39 URL: https://icu.unicode.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/234727/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/icu4j -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2242488 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 5

[Bug 2249344] New: apache-parent-31 is available
by bugzilla＠redhat.com 15 Dec '23

15 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2249344 Bug ID: 2249344 Summary: apache-parent-31 is available Product: Fedora Version: rawhide Status: NEW Component: apache-parent Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: agrimm(a)gmail.com, ctubbsii(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 31 Upstream release that is considered latest: 31 Current version/release in rawhide: 30-2.fc40 URL: https://maven.apache.org/pom/asf/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/20383/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/apache-parent -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2249344 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2241550] New: objectweb-asm-9.6 is available
by bugzilla＠redhat.com 15 Dec '23

15 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2241550 Bug ID: 2241550 Summary: objectweb-asm-9.6 is available Product: Fedora Version: rawhide Status: NEW Component: objectweb-asm Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: fnasser(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 9.6 Upstream release that is considered latest: 9.6 Current version/release in rawhide: 9.5-3.fc40 URL: http://asm.ow2.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/7177/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/objectweb-asm -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2241550 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2238102] New: apache-commons-compress-1.24.0 is available
by bugzilla＠redhat.com 15 Dec '23

15 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2238102 Bug ID: 2238102 Summary: apache-commons-compress-1.24.0 is available Product: Fedora Version: rawhide Status: NEW Component: apache-commons-compress Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, mkoncek(a)redhat.com, SpikeFedora(a)gmail.com Target Milestone: --- Classification: Fedora Releases retrieved: 1.24.0 Upstream release that is considered latest: 1.24.0 Current version/release in rawhide: 1.21-7.fc40 URL: http://commons.apache.org/proper/commons-compress/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/62/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/apache-commons-compress -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2238102 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 5

[Bug 1955315] New: mockito-3.9.10 is available
by bugzilla＠redhat.com 15 Dec '23

15 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=1955315 Bug ID: 1955315 Summary: mockito-3.9.10 is available Product: Fedora Version: rawhide Status: NEW Component: mockito Keywords: FutureFeature, Triaged Assignee: stuart(a)gathman.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, java-maint-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, mat.booth(a)gmail.com, mizdebsk(a)redhat.com, projects.rg(a)smart.ms, roman(a)fenkhuber.at, stuart(a)gathman.org Target Milestone: --- Classification: Fedora Latest upstream release: 3.9.10 Current version/release in rawhide: 3.5.13-2.fc34 URL: http://mockito.org Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/7297/ -- You are receiving this mail because: You are on the CC list for the bug.

1 40

[Bug 2094142] New: maven-surefire-3.0.0-M7 is available
by bugzilla＠redhat.com 15 Dec '23

15 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2094142 Bug ID: 2094142 Summary: maven-surefire-3.0.0-M7 is available Product: Fedora Version: rawhide Status: NEW Component: maven-surefire Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.0.0-M7 Upstream release that is considered latest: 3.0.0-M7 Current version/release in rawhide: 3.0.0~M6-2.fc37 URL: http://maven.apache.org/surefire/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1944/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/maven-surefire -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2094142

1 11

[Bug 2253559] New: bcel-6.8.0 is available
by bugzilla＠redhat.com 15 Dec '23

15 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2253559 Bug ID: 2253559 Summary: bcel-6.8.0 is available Product: Fedora Version: rawhide Status: NEW Component: bcel Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, richardfearn(a)gmail.com Target Milestone: --- Classification: Fedora Releases retrieved: 6.8.0 Upstream release that is considered latest: 6.8.0 Current version/release in rawhide: 6.7.0-3.fc40 URL: http://www.apache.org/dist/commons/bcel/source/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/171/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/bcel -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2253559 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 4

[Bug 2253929] New: jna-5.14.0 is available
by bugzilla＠redhat.com 10 Dec '23

10 Dec '23

https://bugzilla.redhat.com/show_bug.cgi?id=2253929 Bug ID: 2253929 Summary: jna-5.14.0 is available Product: Fedora Version: rawhide Status: NEW Component: jna Keywords: FutureFeature, Triaged Assignee: zmiklank(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, zmiklank(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 5.14.0 Upstream release that is considered latest: 5.14.0 Current version/release in rawhide: 5.13.0-3.fc39 URL: https://github.com/java-native-access/jna/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1464/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/jna -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2253929 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 0

[Bug 2138977] New: apache-commons-compress-1.22 is available
by bugzilla＠redhat.com 08 Dec '23

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits December 2023