March 2015 - java-sig-commits - Fedora Mailing-Lists

[Bug 1203652] New: tomcat: Duplicate Maven metadata for tomcat-jdbc

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1203652 Bug ID: 1203652 Summary: tomcat: Duplicate Maven metadata for tomcat-jdbc Product: Fedora Version: 22 Component: tomcat Keywords: Regression Assignee: ivan.afonichev(a)gmail.com Reporter: mizdebsk(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com, sgallagh(a)redhat.com Description of problem: Tomcat installs duplicate metadata for tomcat-jdbc Maven artifact. Version-Release number of selected component (if applicable): 7.0.59-3 Steps to Reproduce: xmvn-resolve org.apache.tomcat:tomcat-jdbc Actual results: [WARNING] Ignoring metadata for artifact org.apache.tomcat:tomcat-jdbc:jar:SYSTEM as it has duplicate metadata [WARNING] Ignoring metadata for artifact org.apache.tomcat:tomcat-jdbc:pom:SYSTEM as it has duplicate metadata [ERROR] Unable to resolve artifact org.apache.tomcat:tomcat-jdbc:jar:SYSTEM Expected results: /usr/share/java/tomcat/tomcat-jdbc.jar Additional info: Regression was introduced in: commit ce74ddbcd3beba22fb70cd2dc890efa7409bf97f Author: Stephen Gallagher <sgallagh(a)redhat.com> Date: Tue Mar 3 14:58:21 2015 -0500 Revert to Tomcat 7 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=wfJxJ9VXJ8&a=cc_unsubscribe

8 years, 3 months

1
6
0 / 0

[Bug 1004916] New: Package doesn't provide a sysvinit script or systemd service unit

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1004916 Bug ID: 1004916 Summary: Package doesn't provide a sysvinit script or systemd service unit Product: Fedora Version: 19 Component: activemq Severity: high Assignee: mspaulding06(a)gmail.com Reporter: skottler(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: agrimm(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mspaulding06(a)gmail.com, tdawson(a)redhat.com Description of problem: activemq doesn't provide the necessary scripts/config files to start. Version-Release number of selected component (if applicable): 0:5.6.0-5.fc19 How reproducible: Always. Steps to Reproduce: 1. yum install -y activemq activemq-core 2. try starting the service 3. note there is not a service unit This seems like a fairly major thing to be missing in the packages. Is there another package or metapackage that needs to be installed for it to work? -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=IC3tNZ0uDP&a=cc_unsubscribe

8 years, 3 months

1
15
0 / 0

[Bug 1205627] New: CVE-2015-1810 jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166)

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1205627 Bug ID: 1205627 Summary: CVE-2015-1810 jenkins: HudsonPrivateSecurityRealm allows creation of reserved names (SECURITY-166) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com For users using "'Jenkins' own user database" setting, Jenkins doesn't refuse reserved names, thus allowing privilege escalation. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20... -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=KqlcbN0dDQ&a=cc_unsubscribe

8 years, 3 months

1
15
0 / 0

[Bug 1205622] New: CVE-2015-1807 jenkins: directory traversal from artifacts via symlink (SECURITY-162)

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1205622 Bug ID: 1205622 Summary: CVE-2015-1807 jenkins: directory traversal from artifacts via symlink (SECURITY-162) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com This vulnerability allows users with the job configuration privilege or users with commit access to the build script to access arbitrary files/directories on the master, resulting in the exposure of sensitive information, such as encryption keys. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20... -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=vs9xNW7rJ9&a=cc_unsubscribe

8 years, 3 months

1
15
0 / 0

[Bug 1205620] New: CVE-2015-1806 jenkins: Combination filter Groovy script unsecured (SECURITY-125)

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1205620 Bug ID: 1205620 Summary: CVE-2015-1806 jenkins: Combination filter Groovy script unsecured (SECURITY-125) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com This vulnerability allows users with the job configuration privilege to escalate his privileges, resulting in arbitrary code execution to the master. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20... -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=G0xWdXgoFw&a=cc_unsubscribe

8 years, 3 months

1
15
0 / 0

[Bug 1205616] New: CVE-2015-1814 jenkins: forced API token change (SECURITY-180)

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1205616 Bug ID: 1205616 Summary: CVE-2015-1814 jenkins: forced API token change (SECURITY-180) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com The part of Jenkins that issues a new API token was not adequately protected against anonymous attackers. This allows an attacker to escalate privileges on Jenkins External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20... -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=mpKhqf4MCU&a=cc_unsubscribe

8 years, 3 months

1
16
0 / 0

[Bug 1205615] New: CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177)

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1205615 Bug ID: 1205615 Summary: CVE-2015-1812 CVE-2015-1813 jenkins: Reflective XSS vulnerability (SECURITY-171, SECURITY-177) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jdetiber(a)redhat.com, jialiu(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, msrb(a)redhat.com An attacker without any access to Jenkins can navigate the user to a carefully crafted URL and have the user execute unintended actions. This vulnerability can be used to attack Jenkins inside firewalls from outside so long as the location of Jenkins is known to the attacker. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20... -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=aUngdTWJZ8&a=cc_unsubscribe

8 years, 3 months

1
14
0 / 0

[Bug 1127276] New: CVE-2014-5075 smack: MitM vulnerability

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1127276 Bug ID: 1127276 Summary: CVE-2014-5075 smack: MitM vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: vkaigoro(a)redhat.com CC: brms-jira(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, pavelp(a)redhat.com, puntogil(a)libero.it, tkirby(a)redhat.com, weli(a)redhat.com It was reported [1] that Smack (XMPP client library) is vulnerable to MitM attacks with a crafted SSL certificates. Quote from [1]: ... Details ------- Smack is using Java's `SSLSocket`, which checks the peer certificate using an `X509TrustManager`, but does not perform hostname verification. Therefore, it is possible to redirect the traffic between a Smack-using application and a legitimate XMPP server through the attacker's server, merely by providing a valid certificate for a domain under the attacker's control. In Smack versions 2.2.0 to 3.4.1, a custom `ServerTrustManager` implementation was used, which was supplied with the connection's server name, and performed hostname verification. However, it failed to verify the basicConstraints and nameConstraints of the certificate chain (CVE-2014-0363, http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0363) and has been removed in Smack 4.0.0. Applications using Smack 2.2.0 to 3.4.1 with a custom `TrustManager` did not benefit from `ServerTrustManager` and are vulnerable as well, unless their own `TrustManager` implementation explicitly performs hostname verification. ... [1]: http://seclists.org/bugtraq/2014/Aug/29 -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=vQuZmnHNAP&a=cc_unsubscribe

8 years, 4 months

1
13
0 / 0

[Bug 1079233] New: mockito: update to 1.9.5

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1079233 Bug ID: 1079233 Summary: mockito: update to 1.9.5 Product: Fedora Version: rawhide Component: mockito Assignee: rkennke(a)redhat.com Reporter: msrb(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, omajid(a)redhat.com, rkennke(a)redhat.com Created attachment 877167 --> https://bugzilla.redhat.com/attachment.cgi?id=877167&action=edit update to 1.9.5 Description of problem: Upstream version 1.9.5 is available. Rawhide currently contains version 1.9.0. Attached patch was created by Michael Simacek (see #1040350). -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=dvsIbd2J0V&a=cc_unsubscribe

8 years, 4 months

1
7
0 / 0

[Bug 1195244] New: Mis-configured logging mutes log messages

by Red Hat Bugzilla

https://bugzilla.redhat.com/show_bug.cgi?id=1195244 Bug ID: 1195244 Summary: Mis-configured logging mutes log messages Product: Fedora Version: 22 Component: javapackages-tools Assignee: mizdebsk(a)redhat.com Reporter: leamas.alec(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Created attachment 994371 --> https://bugzilla.redhat.com/attachment.cgi?id=994371&action=edit Test case provoking bug with non-readable metadata. Description of problem: Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. Install DecodeIrCaller from https://copr.fedoraproject.org/coprs/leamas/harctoolbox/ 2. For the example, create a bug: $ sudo chmod 600 /usr/share/maven-metadata/DecodeIrCaller.xml 3.Run attached maven.req. It is a patched version of the thing run by rpmbuild $ ./maven.req 4. Watch in output Processing files: IrpMaster-1.0.2-1.fc21.noarch No handlers could be found for logger "pyxb.binding.basis" No handlers could be found for logger "pyxb.binding.basis" The messages stems from the XML parsing in javapackages/metadata/pyxbmetadata.py around line 59. Obviously, they are not really helpful, loggers should be configure Actual results: Useless messages Expected results: Good messages. Additional info: Same thing is likely to happen for any maven-driver spec given a non-readable metadata dependency. And there are other things which might got wrong, needing configured logger I guess. -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=AcTChb0Kzb&a=cc_unsubscribe

8 years, 5 months

1
15
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits March 2015