java-sig-commits April 2023

java-sig-commits@lists.fedoraproject.org

1 participants
260 discussions

[Bug 2073401] CVE-2022-1278 WildFly: possible information disclosure
by bugzilla＠redhat.com 05 Apr '23

05 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2073401 --- Comment #17 from Product Security DevOps Team <prodsec-dev(a)redhat.com> --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-1278 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2073401

1 0

[Bug 2073401] CVE-2022-1278 WildFly: possible information disclosure
by bugzilla＠redhat.com 05 Apr '23

05 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2073401 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:1661 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2073401

1 0

[Bug 2073401] CVE-2022-1278 WildFly: possible information disclosure
by bugzilla＠redhat.com 05 Apr '23

05 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2073401 --- Comment #16 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: AMQ Broker 7.11.0 Via RHSA-2023:1661 https://access.redhat.com/errata/RHSA-2023:1661 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2073401

1 0

[Bug 2137685] New: google-gson-2.10 is available
by bugzilla＠redhat.com 04 Apr '23

04 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2137685 Bug ID: 2137685 Summary: google-gson-2.10 is available Product: Fedora Version: rawhide Status: NEW Component: google-gson Keywords: FutureFeature, Triaged Assignee: mat.booth(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dchen(a)redhat.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com, mat.booth(a)gmail.com, mizdebsk(a)redhat.com, sergio(a)serjux.com Target Milestone: --- Classification: Fedora Releases retrieved: 2.10 Upstream release that is considered latest: 2.10 Current version/release in rawhide: 2.9.1-1.fc38 URL: https://github.com/google/gson Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1232/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/google-gson -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2137685

1 7

[Bug 2055480] New: CVE-2021-22060 springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096)
by bugzilla＠redhat.com 04 Apr '23

04 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2055480 Bug ID: 2055480 Summary: CVE-2021-22060 springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096) Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: jwon(a)redhat.com CC: aboyko(a)redhat.com, ahenning(a)redhat.com, aileenc(a)redhat.com, alazarot(a)redhat.com, anstephe(a)redhat.com, chazlett(a)redhat.com, dchen(a)redhat.com, drieden(a)redhat.com, emingora(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gmalinko(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jochrist(a)redhat.com, jolee(a)redhat.com, jrokos(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, lsurette(a)redhat.com, michal.skrivanek(a)redhat.com, mnovotny(a)redhat.com, mperina(a)redhat.com, pdelbell(a)redhat.com, pjindal(a)redhat.com, pskopek(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, sbonazzo(a)redhat.com, sguilhen(a)redhat.com, tzimanyi(a)redhat.com Blocks: 2044407 Target Milestone: --- Classification: Other In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase. https://nvd.nist.gov/vuln/detail/CVE-2021-22060 https://tanzu.vmware.com/security/cve-2021-22060 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2055480

1 8

[Bug 2034584] New: CVE-2021-22096 springframework: malicious input leads to insertion of additional log entries
by bugzilla＠redhat.com 04 Apr '23

04 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2034584 Bug ID: 2034584 Summary: CVE-2021-22096 springframework: malicious input leads to insertion of additional log entries Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: aboyko(a)redhat.com, ahenning(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, chazlett(a)redhat.com, dchen(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gmalinko(a)redhat.com, hvyas(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jochrist(a)redhat.com, jolee(a)redhat.com, jrokos(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, lef(a)fedoraproject.org, lsurette(a)redhat.com, michal.skrivanek(a)redhat.com, mnovotny(a)redhat.com, mperina(a)redhat.com, pdelbell(a)redhat.com, pjindal(a)redhat.com, pskopek(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, sbonazzo(a)redhat.com, sguilhen(a)redhat.com, tzimanyi(a)redhat.com Target Milestone: --- Classification: Other In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. References: https://tanzu.vmware.com/security/cve-2021-22096 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2034584

1 16

[Bug 2182532] New: jackson-databind-2.15.0-rc2 is available
by bugzilla＠redhat.com 04 Apr '23

04 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2182532 Bug ID: 2182532 Summary: jackson-databind-2.15.0-rc2 is available Product: Fedora Version: rawhide Status: NEW Component: jackson-databind Keywords: FutureFeature, Triaged Assignee: ckelley(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: cdorney(a)redhat.com, cfu(a)redhat.com, ckelley(a)redhat.com, edewata(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jmagne(a)redhat.com, mfargett(a)redhat.com, mharmsen(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Releases retrieved: 2.15.0-rc2 Upstream release that is considered latest: 2.15.0-rc2 Current version/release in rawhide: 2.14.2-1.fc38 URL: https://github.com/FasterXML/jackson-databind/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/10963/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/jackson-databind -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2182532

1 1

[Bug 2182533] New: jackson-core-2.15.0-rc2 is available
by bugzilla＠redhat.com 04 Apr '23

04 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2182533 Bug ID: 2182533 Summary: jackson-core-2.15.0-rc2 is available Product: Fedora Version: rawhide Status: NEW Component: jackson-core Keywords: FutureFeature, Triaged Assignee: ckelley(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: cdorney(a)redhat.com, cfu(a)redhat.com, ckelley(a)redhat.com, edewata(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jmagne(a)redhat.com, mfargett(a)redhat.com, mharmsen(a)redhat.com, puntogil(a)libero.it, roman(a)fenkhuber.at Target Milestone: --- Classification: Fedora Releases retrieved: 2.15.0-rc2 Upstream release that is considered latest: 2.15.0-rc2 Current version/release in rawhide: 2.14.2-1.fc38 URL: https://github.com/FasterXML/jackson-core Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/10962/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/jackson-core -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2182533

1 1

[Bug 2182483] New: jackson-annotations-2.15.0-rc2 is available
by bugzilla＠redhat.com 04 Apr '23

04 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=2182483 Bug ID: 2182483 Summary: jackson-annotations-2.15.0-rc2 is available Product: Fedora Version: rawhide Status: NEW Component: jackson-annotations Keywords: FutureFeature, Triaged Assignee: ckelley(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: cdorney(a)redhat.com, cfu(a)redhat.com, ckelley(a)redhat.com, edewata(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jmagne(a)redhat.com, mfargett(a)redhat.com, mharmsen(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Releases retrieved: 2.15.0-rc2 Upstream release that is considered latest: 2.15.0-rc2 Current version/release in rawhide: 2.14.2-1.fc38 URL: https://github.com/FasterXML/jackson-annotations Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/89327/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/jackson-annotations -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2182483

1 1

[Bug 1763544] javacc-7.0.12 is available
by bugzilla＠redhat.com 04 Apr '23

04 Apr '23

https://bugzilla.redhat.com/show_bug.cgi?id=1763544 --- Comment #14 from Jerry James <loganjerry(a)gmail.com> --- I finally did this about 12 hours ago. However, I absent-mindedly forgot that freemarker needs a patch to build successfully with 7.0.12. The freemarker build.xml changes the string "private final LookaheadSuccess" to "private static final LookaheadSuccess" in the javacc-generated files. However, in javacc 7.0.12, the declaration is "static private final LookaheadSuccess". After the freemarker replacement, that is "static private static final LookaheadSuccess". The double static declaration is an error. There is an existing freemarker PR to address this. I opened a PR for the Fedora package here: https://src.fedoraproject.org/rpms/freemarker/pull-request/7. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1763544

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits April 2023