java-sig-commits December 2020

java-sig-commits@lists.fedoraproject.org

1 participants
240 discussions

[Bug 1909865] New: plantuml should depend on java, not java-headless
by bugzilla＠redhat.com 10 Jan '22

10 Jan '22

https://bugzilla.redhat.com/show_bug.cgi?id=1909865 Bug ID: 1909865 Summary: plantuml should depend on java, not java-headless Product: Fedora Version: 33 Status: NEW Component: plantuml Assignee: jsafrane(a)redhat.com Reporter: omajid(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, jsafrane(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora I didn't have plantuml installed. So I installed it, but it threw an exception: $ plantuml bash: plantuml: command not found... Install package 'plantuml' to provide command 'plantuml'? [N/y] y * Waiting in queue... The following packages have to be installed: javapackages-tools-5.3.0-13.fc33.noarch Macros and scripts for Java packaging support plantuml-1:1.2019.1-6.fc33.noarch Program to generate UML diagram from a text description Proceed with changes? [N/y] y * Waiting in queue... * Waiting for authentication... * Waiting in queue... * Downloading packages... * Requesting data... * Testing changes... * Installing packages... Exception in thread "main" java.lang.UnsatisfiedLinkError: Can't load library: /usr/lib/jvm/java-11-openjdk-11.0.9.11-4.fc33.x86_64/lib/libawt_xawt.so at java.base/java.lang.ClassLoader.loadLibrary(ClassLoader.java:2630) at java.base/java.lang.Runtime.load0(Runtime.java:768) at java.base/java.lang.System.load(System.java:1837) at java.base/java.lang.ClassLoader$NativeLibrary.load0(Native Method) at java.base/java.lang.ClassLoader$NativeLibrary.load(ClassLoader.java:2442) at java.base/java.lang.ClassLoader$NativeLibrary.loadLibrary(ClassLoader.java:2498) at java.base/java.lang.ClassLoader.loadLibrary0(ClassLoader.java:2694) at java.base/java.lang.ClassLoader.loadLibrary(ClassLoader.java:2648) at java.base/java.lang.Runtime.loadLibrary0(Runtime.java:830) at java.base/java.lang.System.loadLibrary(System.java:1873) at java.desktop/java.awt.image.ColorModel$1.run(ColorModel.java:209) at java.desktop/java.awt.image.ColorModel$1.run(ColorModel.java:207) at java.base/java.security.AccessController.doPrivileged(Native Method) at java.desktop/java.awt.image.ColorModel.loadLibraries(ColorModel.java:206) at java.desktop/java.awt.image.ColorModel.<clinit>(ColorModel.java:219) at java.desktop/java.awt.image.BufferedImage.<clinit>(BufferedImage.java:286) at net.sourceforge.plantuml.FileFormat.<clinit>(FileFormat.java:85) at net.sourceforge.plantuml.Option.<init>(Option.java:93) at net.sourceforge.plantuml.Run.main(Run.java:87) It looks like it wants to use libawt_xawt.so and so should require java, not java-headless: $ ls /usr/lib/jvm/java-11-openjdk-11.0.9.11-4.fc33.x86_64/lib/ classlist jspawnhelper libdt_socket.so libj2pcsc.so libjdwp.so libmanagement_agent.so libnio.so libsunec.so psfontj2d.properties jexec jvm.cfg libextnet.so libj2pkcs11.so libjimage.so libmanagement_ext.so libprefs.so libunpack.so psfont.properties.ja jfr libattach.so libfontmanager.so libjaas.so libjsig.so libmanagement.so librmi.so libverify.so security jli libawt_headless.so libinstrument.so libjavajpeg.so libjsound.so libmlib_image.so libsaproc.so libzip.so server jrt-fs.jar libawt.so libj2gss.so libjava.so liblcms.so libnet.so libsctp.so modules tzdb.dat $ rpm -q plantuml plantuml-1.2019.1-6.fc33.noarch $ rpm -q plantuml --requires /usr/bin/bash java-headless javapackages-filesystem javapackages-tools rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(FileDigests) <= 4.6.0-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rpmlib(PayloadIsZstd) <= 5.4.18-1 $ sudo dnf install /usr/lib/jvm/java-11-openjdk-11.0.9.11-4.fc33.x86_64/lib/libawt_xawt.so [sudo] password for omajid: Last metadata expiration check: 5:50:49 ago on Mon 21 Dec 2020 09:51:27 AM EST. Dependencies resolved. ============================================================================================================================================================== Package Architecture Version Repository Size ============================================================================================================================================================== Installing: java-11-openjdk x86_64 1:11.0.9.11-4.fc33 updates 250 k Installing dependencies: ttmkfdir x86_64 3.0.9-62.fc33 fedora 52 k xorg-x11-fonts-Type1 noarch 7.5-25.fc33 fedora 501 k -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1908837] New: CVE-2020-26259 XStream: arbitrary file deletion on the local host when unmarshalling
by bugzilla＠redhat.com 14 Dec '21

14 Dec '21

https://bugzilla.redhat.com/show_bug.cgi?id=1908837 Bug ID: 1908837 Summary: CVE-2020-26259 XStream: arbitrary file deletion on the local host when unmarshalling Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: abenaiss(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, aos-bugs(a)redhat.com, ataylor(a)redhat.com, bibryam(a)redhat.com, bmontgom(a)redhat.com, chazlett(a)redhat.com, dchen(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, hbraun(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jcoleman(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lkundrak(a)v3.sk, mizdebsk(a)redhat.com, mnovotny(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, pantinor(a)redhat.com, pbhattac(a)redhat.com, pjindal(a)redhat.com, rrajasek(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sdaley(a)redhat.com, sponnaga(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, vbobade(a)redhat.com, vhalbert(a)redhat.com Target Milestone: --- Classification: Other XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories. References: https://github.com/x-stream/xstream/security/advisories/GHSA-jfvx-7wrx-43fh https://x-stream.github.io/CVE-2020-26259.html -- You are receiving this mail because: You are on the CC list for the bug.

1 21

[Bug 1904221] New: CVE-2020-17527 tomcat: HTTP/2 request header mix-up
by bugzilla＠redhat.com 14 Dec '21

14 Dec '21

https://bugzilla.redhat.com/show_bug.cgi?id=1904221 Bug ID: 1904221 Summary: CVE-2020-17527 tomcat: HTTP/2 request header mix-up Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bgeorges(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, cmoulliard(a)redhat.com, coolsvap(a)gmail.com, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dbecker(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eleandro(a)redhat.com, etirelli(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gzaronik(a)redhat.com, hhorak(a)redhat.com, huwang(a)redhat.com, ibek(a)redhat.com, ikanello(a)redhat.com, ivan.afonichev(a)gmail.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jclere(a)redhat.com, jjoyce(a)redhat.com, jochrist(a)redhat.com, jolee(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschatte(a)redhat.com, jschluet(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com, mbabacek(a)redhat.com, mburns(a)redhat.com, mizdebsk(a)redhat.com, mkolesni(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, rguimara(a)redhat.com, rhcs-maint(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sclewis(a)redhat.com, scohen(a)redhat.com, sdaley(a)redhat.com, slinaber(a)redhat.com, smaestri(a)redhat.com, tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com, weli(a)redhat.com Target Milestone: --- Classification: Other While investigating Bug 64830 it was discovered that Apache Tomcat could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests. Reference: https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c… -- You are receiving this mail because: You are on the CC list for the bug.

1 25

[Bug 1887648] New: CVE-2020-13943 tomcat: Apache Tomcat HTTP/2 Request mix-up
by bugzilla＠redhat.com 14 Dec '21

14 Dec '21

https://bugzilla.redhat.com/show_bug.cgi?id=1887648 Bug ID: 1887648 Summary: CVE-2020-13943 tomcat: Apache Tomcat HTTP/2 Request mix-up Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: jwon(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bgeorges(a)redhat.com, bmaxwell(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, cmoulliard(a)redhat.com, coolsvap(a)gmail.com, csutherl(a)redhat.com, darran.lofthouse(a)redhat.com, dbecker(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eleandro(a)redhat.com, etirelli(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gzaronik(a)redhat.com, hhorak(a)redhat.com, huwang(a)redhat.com, ibek(a)redhat.com, ikanello(a)redhat.com, ivan.afonichev(a)gmail.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jclere(a)redhat.com, jjoyce(a)redhat.com, jochrist(a)redhat.com, jolee(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschatte(a)redhat.com, jschluet(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com, kwills(a)redhat.com, lgao(a)redhat.com, lhh(a)redhat.com, lpeer(a)redhat.com, lthon(a)redhat.com, mbabacek(a)redhat.com, mburns(a)redhat.com, mizdebsk(a)redhat.com, mkolesni(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, rguimara(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, sclewis(a)redhat.com, scohen(a)redhat.com, sdaley(a)redhat.com, slinaber(a)redhat.com, smaestri(a)redhat.com, tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com, weli(a)redhat.com Blocks: 1887641 Target Milestone: --- Classification: Other If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. Upstream commits: Tomcat 10.0: https://github.com/apache/tomcat/commit/1bbc650cbc3f08d85a1ec6d803c47ae53a8… Tomcat 9.0: https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2… Tomcat 8.5: https://github.com/apache/tomcat/commit/9d7def063b47407a09a2f9202beed99f4dc… Reference: http://mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b7… -- You are receiving this mail because: You are on the CC list for the bug.

1 13

[Bug 1851019] New: CVE-2020-2875mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
by bugzilla＠redhat.com 14 Dec '21

14 Dec '21

https://bugzilla.redhat.com/show_bug.cgi?id=1851019 Bug ID: 1851019 Summary: CVE-2020-2875mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: mkaplan(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bgeorges(a)redhat.com, bibryam(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, clement.escoffier(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, databases-maint(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gmorling(a)redhat.com, gsmet(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcoleman(a)redhat.com, jjanco(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lthon(a)redhat.com, mmuzila(a)redhat.com, mnovotny(a)redhat.com, mschorm(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, odubaj(a)redhat.com, pantinor(a)redhat.com, paradhya(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbiarozk(a)redhat.com, sdaley(a)redhat.com, sdouglas(a)redhat.com, smaestri(a)redhat.com, sponnaga(a)redhat.com, steve.traylen(a)cern.ch, tcunning(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com, xjakub(a)fi.muni.cz Target Milestone: --- Classification: Other Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. References: https://www.oracle.com/security-alerts/cpuapr2020.html https://lists.debian.org/debian-lts-announce/2020/06/msg00015.html https://www.debian.org/security/2020/dsa-4703 -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1851014] New: CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
by bugzilla＠redhat.com 14 Dec '21

14 Dec '21

https://bugzilla.redhat.com/show_bug.cgi?id=1851014 Bug ID: 1851014 Summary: CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mkaplan(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bgeorges(a)redhat.com, bibryam(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, clement.escoffier(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, databases-maint(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gmorling(a)redhat.com, gsmet(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcoleman(a)redhat.com, jjanco(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lthon(a)redhat.com, mmuzila(a)redhat.com, mnovotny(a)redhat.com, mschorm(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, odubaj(a)redhat.com, pantinor(a)redhat.com, paradhya(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbiarozk(a)redhat.com, sdaley(a)redhat.com, sdouglas(a)redhat.com, smaestri(a)redhat.com, sponnaga(a)redhat.com, steve.traylen(a)cern.ch, tcunning(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com, xjakub(a)fi.muni.cz Target Milestone: --- Classification: Other Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 1785711] New: CVE-2019-17563 tomcat: session fixation
by bugzilla＠redhat.com 30 Nov '21

30 Nov '21

https://bugzilla.redhat.com/show_bug.cgi?id=1785711 Bug ID: 1785711 Summary: CVE-2019-17563 tomcat: session fixation Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, chazlett(a)redhat.com, coolsvap(a)gmail.com, csutherl(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gzaronik(a)redhat.com, ibek(a)redhat.com, ivan.afonichev(a)gmail.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jclere(a)redhat.com, jochrist(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com, lgao(a)redhat.com, mbabacek(a)redhat.com, mnovotny(a)redhat.com, myarboro(a)redhat.com, paradhya(a)redhat.com, pjindal(a)redhat.com, rhcs-maint(a)redhat.com, rrajasek(a)redhat.com, rsynek(a)redhat.com, sdaley(a)redhat.com, weli(a)redhat.com Target Milestone: --- Classification: Other When using FORM authentication there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability. Reference: https://tomcat.apache.org/security-7.html https://tomcat.apache.org/security-8.html http://tomcat.apache.org/security-9.html Upstream commits: https://github.com/apache/tomcat/commit/ab72a10 https://github.com/apache/tomcat/commit/e19a202 https://github.com/apache/tomcat/commit/1ecba14 -- You are receiving this mail because: You are on the CC list for the bug.

1 41

[Bug 1858077] New: relaxngcc fails to build with java-11-openjdk
by bugzilla＠redhat.com 30 Nov '21

30 Nov '21

https://bugzilla.redhat.com/show_bug.cgi?id=1858077 Bug ID: 1858077 Summary: relaxngcc fails to build with java-11-openjdk Product: Fedora Version: rawhide Hardware: All OS: All Status: NEW Component: relaxngcc Severity: high Assignee: sanjay.ankur(a)gmail.com Reporter: jvanek(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-maint-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com, puntogil(a)libero.it, sanjay.ankur(a)gmail.com, sgehwolf(a)redhat.com Blocks: 1825969 (Java11) Target Milestone: --- Classification: Fedora relaxngcc fails to build with java-11-openjdk as sytem JDK. See https://fedoraproject.org/wiki/Changes/Java11 . See especially part about known failures: https://fedoraproject.org/wiki/Changes/Java11#common_issues_packagers_can_f… For the build logs, see: https://koji.fedoraproject.org/koji/taskinfo?taskID=47161757 We run the rebuild longer then 10days ago. Log may be gone. Also your package may be passing in regular rawhide. To reproduce, simply: fedpkg clone relaxngcc; cd relaxngcc; fedpkg build --target f33-java11; #The target is crucial. We run two reruns your package failed both. We had tried 650 packages, and 500 had passed, so the java-11-openjdk will be system JDK in f33, and you should fix your package if you want to keep it alive. Usually the fix is simple, and best is to update the package to latest upstream version. There will be usual mass rebuild once f33 branches. You may got another FTBFS bug. Let us know here if you have any questions, here in bug, or at java-devel(a)lists.fedoraproject.org . We'd appreciate help from the people who know this package best, but if you don't want to work on this now, let us know so we can try to work around it on our side if needed. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1825969 [Bug 1825969] java-11-openjdk as system JDK in F33 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1858073] New: powermock fails to build with java-11-openjdk
by bugzilla＠redhat.com 30 Nov '21

30 Nov '21

https://bugzilla.redhat.com/show_bug.cgi?id=1858073 Bug ID: 1858073 Summary: powermock fails to build with java-11-openjdk Product: Fedora Version: rawhide Hardware: All OS: All Status: NEW Component: powermock Severity: high Assignee: rkennke(a)redhat.com Reporter: jvanek(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dchen(a)redhat.com, decathorpe(a)gmail.com, java-maint-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, jvanek(a)redhat.com, neugens(a)redhat.com, rkennke(a)redhat.com, sgehwolf(a)redhat.com Blocks: 1825969 (Java11) Target Milestone: --- Classification: Fedora powermock fails to build with java-11-openjdk as sytem JDK. See https://fedoraproject.org/wiki/Changes/Java11 . See especially part about known failures: https://fedoraproject.org/wiki/Changes/Java11#common_issues_packagers_can_f… For the build logs, see: https://koji.fedoraproject.org/koji/taskinfo?taskID=47161350 We run the rebuild longer then 10days ago. Log may be gone. Also your package may be passing in regular rawhide. To reproduce, simply: fedpkg clone powermock; cd powermock; fedpkg build --target f33-java11; #The target is crucial. We run two reruns your package failed both. We had tried 650 packages, and 500 had passed, so the java-11-openjdk will be system JDK in f33, and you should fix your package if you want to keep it alive. Usually the fix is simple, and best is to update the package to latest upstream version. There will be usual mass rebuild once f33 branches. You may got another FTBFS bug. Let us know here if you have any questions, here in bug, or at java-devel(a)lists.fedoraproject.org . We'd appreciate help from the people who know this package best, but if you don't want to work on this now, let us know so we can try to work around it on our side if needed. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1825969 [Bug 1825969] java-11-openjdk as system JDK in F33 -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1835508] New: powermock tests incompatible with assertj-core 3.11.0+
by bugzilla＠redhat.com 30 Nov '21

30 Nov '21

https://bugzilla.redhat.com/show_bug.cgi?id=1835508 Bug ID: 1835508 Summary: powermock tests incompatible with assertj-core 3.11.0+ Product: Fedora Version: rawhide Status: NEW Component: powermock Assignee: rkennke(a)redhat.com Reporter: decathorpe(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: dingyichen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, neugens(a)redhat.com, rkennke(a)redhat.com Target Milestone: --- Classification: Fedora I've tried to update assertj-core to the latest version, but there have been minor API changes that powermock does not seem to be compatible with: https://copr.fedorainfracloud.org/coprs/decathorpe/assertj-core-fixes-pr/bu… The first issues seems to be caused by this upstream commit: https://github.com/joel-costigliola/assertj-core/commit/de6e751563640c7d157… In this file: powermock-core/src/test/java/org/powermock/core/classloader/MockClassLoaderFactoryTest.java Replacing .are(contains(foo)) with .isEqualsTo(foo) fixes these two issues. However, they are not the only problems, and I've not been able to fix the rest, and error messages for closures seem to be especially unhelpful in Java. -- You are receiving this mail because: You are on the CC list for the bug.

1 8

← Newer
1
2
3
4
5
6
7
8
...
24
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits December 2020