https://bugzilla.redhat.com/show_bug.cgi?id=2381540
Bug ID: 2381540
Summary: Please branch and build maven-shade-plugin in epel10
Product: Fedora
Version: 42
OS: Linux
Status: NEW
Component: maven-shade-plugin
Severity: medium
Assignee: deamicis(a)bluewin.ch
Reporter: jean-louis(a)dupond.be
QA Contact: extras-qa(a)fedoraproject.org
CC: deamicis(a)bluewin.ch,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Target Milestone: ---
Classification: Fedora
Can we add maven-shade-plugin in epel10 please?
Reproducible: Always
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2381540
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2103340
Bug ID: 2103340
Summary: log4j-2.18.0 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: log4j
Keywords: FutureFeature, Triaged
Assignee: paul.wouters(a)aiven.io
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: dbhole(a)redhat.com, devrim(a)gunduz.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com, paul.wouters(a)aiven.io
Target Milestone: ---
Classification: Fedora
Releases retrieved: 2.18.0
Upstream release that is considered latest: 2.18.0
Current version/release in rawhide: 2.17.2-2.fc37
URL: http://www.apache.org/dist/logging/log4j
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://fedoraproject.org/wiki/Upstream_release_monitoring
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from Anitya:
https://release-monitoring.org/project/1836/
To change the monitoring settings for the project, please visit:
https://src.fedoraproject.org/rpms/log4j
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2103340
https://bugzilla.redhat.com/show_bug.cgi?id=2395967
Bug ID: 2395967
Summary: CVE-2025-41249 velocity: Spring Framework Annotation
Detection Vulnerability [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["1c9628d4-6b02-4ccb-9766-4168687de0a6"]}
Component: velocity
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: mizdebsk(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: devrim(a)gunduz.org,
java-sig-commits(a)lists.fedoraproject.org,
mizdebsk(a)redhat.com
Blocks: 2395725
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2395967
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2395966
Bug ID: 2395966
Summary: CVE-2025-41249 resteasy: Spring Framework Annotation
Detection Vulnerability [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["1c9628d4-6b02-4ccb-9766-4168687de0a6"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: edewata(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2395725
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2395966
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2392309
Bug ID: 2392309
Summary: [Minor Incident] CVE-2025-9784 resteasy: Undertow
MadeYouReset HTTP/2 DDoS Vulnerability [fedora-all]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["1682c085-9e87-444f-bfdc-461cd9303fc6"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: edewata(a)redhat.com
Reporter: jiahuja(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2392306 (CVE-2025-9784)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2392306
[Bug 2392306] CVE-2025-9784 undertow: Undertow MadeYouReset HTTP/2 DDoS
Vulnerability
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2392309
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2389237
Bug ID: 2389237
Summary: CVE-2025-41242 resteasy: Spring Framework MVC path
traversal vulnerability [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["f8195245-d684-4e4b-a716-c291e759c1e4"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: edewata(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2389113
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2389237
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2389233
Bug ID: 2389233
Summary: CVE-2025-9092 resteasy: Bouncycastle Resource
Exhaustion [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["92a7d168-1807-4b9d-ad1d-821abf7684fb"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: edewata(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2388912
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2389233
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2389228
Bug ID: 2389228
Summary: CVE-2025-9092 apache-commons-vfs: Bouncycastle
Resource Exhaustion [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["92a7d168-1807-4b9d-ad1d-821abf7684fb"]}
Component: apache-commons-vfs
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: gwync(a)protonmail.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
gwync(a)protonmail.com,
java-sig-commits(a)lists.fedoraproject.org,
michel(a)michel-slm.name, puntogil(a)libero.it
Blocks: 2388912
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2389228
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2388292
Bug ID: 2388292
Summary: CVE-2025-8916 resteasy: BouncyCastle denial of service
[fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["de52cbfa-b458-405d-bb3f-5aaf784d818a"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: edewata(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2388195
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2388292
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…