java-sig-commits June 2020

java-sig-commits@lists.fedoraproject.org

1 participants
390 discussions

[Bug 1815212] New: CVE-2020-1953 apache-commons-configuration: uncontrolled class instantiation when loading YAML files
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1815212 Bug ID: 1815212 Summary: CVE-2020-1953 apache-commons-configuration: uncontrolled class instantiation when loading YAML files Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, ataylor(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bgeorges(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, dblechte(a)redhat.com, decathorpe(a)gmail.com, dfediuck(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eedri(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, fnasser(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, hvyas(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcoleman(a)redhat.com, jjelen(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lthon(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mizdebsk(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puebele(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbonazzo(a)redhat.com, sdaley(a)redhat.com, sherold(a)redhat.com, smaestri(a)redhat.com, SpikeFedora(a)gmail.com, sponnaga(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, vbellur(a)redhat.com, yturgema(a)redhat.com Target Milestone: --- Classification: Other Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application. References: https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882… https://lists.apache.org/thread.html/rde2186ad6ac0d6ed8d51af7509244adcf1ce0… -- You are receiving this mail because: You are on the CC list for the bug.

1 19

[Bug 1815213] New: CVE-2020-1953 apache-commons-configuration: uncontrolled class instantiation when loading YAML files [fedora-all]
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1815213 Bug ID: 1815213 Summary: CVE-2020-1953 apache-commons-configuration: uncontrolled class instantiation when loading YAML files [fedora-all] Product: Fedora Version: 31 Status: NEW Component: apache-commons-configuration Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: jjelen(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, fnasser(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jjelen(a)redhat.com, SpikeFedora(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1799477] New: CVE-2020-5398 springframework: RFD attack via Content-Disposition Header sourced from request input by Spring MVC or Spring WebFlux Application [fedora-all]
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1799477 Bug ID: 1799477 Summary: CVE-2020-5398 springframework: RFD attack via Content-Disposition Header sourced from request input by Spring MVC or Spring WebFlux Application [fedora-all] Product: Fedora Version: 31 Status: NEW Component: springframework Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: extras-orphan(a)fedoraproject.org Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: dingyichen(a)gmail.com, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1797080] New: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1797080 Bug ID: 1797080 Summary: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: psampaio(a)redhat.com CC: abenaiss(a)redhat.com, adam.kaplan(a)redhat.com, aos-bugs(a)redhat.com, bmontgom(a)redhat.com, eparis(a)redhat.com, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jburrell(a)redhat.com, jokerman(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, nstielau(a)redhat.com, pbhattac(a)redhat.com, sponnaga(a)redhat.com, vbobade(a)redhat.com, wzheng(a)redhat.com Target Milestone: --- Classification: Other Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents. References: https://jenkins.io/security/advisory/2020-01-29/#SECURITY-1682 http://www.openwall.com/lists/oss-security/2020/01/29/1 -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1797081] New: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass [fedora-all]
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1797081 Bug ID: 1797081 Summary: CVE-2020-2099 jenkins: Inbound TCP Agent Protocol/3 authentication bypass [fedora-all] Product: Fedora Version: 31 Status: NEW Component: jenkins Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: extras-orphan(a)fedoraproject.org Reporter: psampaio(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1691250] New: Upgrade snmp4j to 3.0.2
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1691250 Bug ID: 1691250 Summary: Upgrade snmp4j to 3.0.2 Product: Fedora Version: rawhide Status: NEW Component: snmp4j Keywords: Rebase Assignee: puntogil(a)libero.it Reporter: sbonazzo(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Fedora currently ships 2.4.1 (2015-12-30) while upstream released 3.0.2 (2018-10-10) -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1663016] New: OpenNLP 1.9.1 available
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1663016 Bug ID: 1663016 Summary: OpenNLP 1.9.1 available Product: Fedora Version: 29 Hardware: x86_64 OS: Linux Status: NEW Component: opennlp Severity: low Assignee: puntogil(a)libero.it Reporter: edgar.hoch(a)ims.uni-stuttgart.de QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Created attachment 1518001 --> https://bugzilla.redhat.com/attachment.cgi?id=1518001&action=edit opennlp.spec for 1.9.1 Description of problem: OpenNLP package distributed by Fedora 29 is more that four years old. Current OpenNLP version is 1.9.1. I have used the spec file of opennlp-1.5.3-7.fc29 and modified it until mock creates packages for version 1.9.1. It may be that it can be more optimized. It would be nice if someone could check it and creates updated packages for the public. Version-Release number of selected component (if applicable): opennlp-1.5.3-7.fc29.noarch -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1814204] New: fop 2.4 update breaks maven-doxia builds on fedora 31
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1814204 Bug ID: 1814204 Summary: fop 2.4 update breaks maven-doxia builds on fedora 31 Product: Fedora Version: 31 Status: NEW Component: fop Assignee: rlandman(a)redhat.com Reporter: decathorpe(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: c.david86(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, rhbugs(a)n-dimensional.de, rlandman(a)redhat.com, tim(a)tim-landscheidt.de Target Milestone: --- Classification: Fedora From the build log of maven-doxia: [ERROR] Failed to execute goal on project doxia-module-fo: Could not resolve dependencies for project org.apache.maven.doxia:doxia-module-fo:jar:1.7: Failed to collect dependencies at org.apache.xmlgraphics:fop:jar:2.0: Failed to read artifact descriptor for org.apache.xmlgraphics:fop:jar:2.0: Cannot access central (https://repo.maven.apache.org/maven2) in offline mode and the artifact org.apache.xmlgraphics:fop-parent:pom:2.4 has not been downloaded from it before. -> [Help 1] Looks like the new(?) maven dependency mvn(org.apache.xmlgraphics:fop-parent) is not provided by the fop package, which breaks this build now. See: https://koschei.fedoraproject.org/package/maven-doxia?collection=f31 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1816387] New: [abrt] weka-3.6.14-11.fc31: Uncaught exception java.lang.ThreadDeath in method weka.gui.explorer.ClassifierPanel$16.run()
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1816387 Bug ID: 1816387 Summary: [abrt] weka-3.6.14-11.fc31: Uncaught exception java.lang.ThreadDeath in method weka.gui.explorer.ClassifierPanel$16.run() Product: Fedora Version: 31 Hardware: x86_64 Status: NEW Whiteboard: abrt_hash:06e91bf0d137b8e325885e47dd43d86053a4141c; Component: weka Assignee: extras-orphan(a)fedoraproject.org Reporter: kamikazenh(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it, xjakub(a)fi.muni.cz Target Milestone: --- Classification: Fedora Version-Release number of selected component: weka-3.6.14-11.fc31 Additional info: reporter: libreport-2.12.0 abrt-java-connector: 1.1.4 cmdline: /usr/lib/jvm/jre-1.8.0-openjdk/bin/java -agentpath:/usr/lib/abrt-java-connector/libabrt-java-connector.so=abrt=on, -classpath /usr/share/java/weka.jar:/usr/share/java/java_cup.jar:/usr/share/java/libsvm.jar:/usr/share/java/hsqldb.jar:/usr/share/java/mysql-connector-java.jar:/usr/share/java/postgresql.jar weka.gui.GUIChooser executable: /usr/share/java/weka.jar java_executable: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.fc31.x86_64/jre/bin/java kernel: 5.5.10-200.fc31.x86_64 pid: 4540 pkg_fingerprint: 50CB 390B 3C33 59C4 pkg_vendor: Fedora Project runlevel: N 5 uid: 1000 Truncated backtrace: #1 java.lang.ThreadDeath #2 at java.lang.Thread.stop(Thread.java:853) [file:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.fc31.x86_64/jre/lib/rt.jar] #3 at weka.gui.explorer.ClassifierPanel.stopClassifier(ClassifierPanel.java:2656) [file:/usr/share/java/weka.jar] #4 at weka.gui.explorer.ClassifierPanel$10.actionPerformed(ClassifierPanel.java:585) [file:/usr/share/java/weka.jar] #5 at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:2022) [file:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.fc31.x86_64/jre/lib/rt.jar] #6 at javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2348) [file:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.fc31.x86_64/jre/lib/rt.jar] #7 at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:402) [file:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.fc31.x86_64/jre/lib/rt.jar] #8 at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:259) [file:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.fc31.x86_64/jre/lib/rt.jar] #9 at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(BasicButtonListener.java:252) [file:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.fc31.x86_64/jre/lib/rt.jar] #10 at java.awt.AWTEventMulticaster.mouseReleased(AWTEventMulticaster.java:289) [file:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.242.b08-0.fc31.x86_64/jre/lib/rt.jar] -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1768661] New: thredds-dap, thredds-tdcommon and thredds-tdm uninstallable
by bugzilla＠redhat.com 24 Nov '20

24 Nov '20

https://bugzilla.redhat.com/show_bug.cgi?id=1768661 Bug ID: 1768661 Summary: thredds-dap, thredds-tdcommon and thredds-tdm uninstallable Product: Fedora Version: 31 Status: NEW Component: thredds Assignee: extras-orphan(a)fedoraproject.org Reporter: phil(a)fifi.org QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Description of problem: None of thredds-dap, thredds-tdcommon and thredds-tdm can be installed. Version-Release number of selected component (if applicable): thredds-dap-4.6.2-10.fc31.noarch thredds-tdcommon-4.6.2-10.fc31.noarch thredds-tdm-4.6.2-10.fc31.noarch How reproducible: Always Steps to Reproduce: 1. dnf install thredds-dap-4.6.2-10.fc31.noarch thredds-tdcommon-4.6.2-10.fc31.noarch thredds-tdm-4.6.2-10.fc31.noarch Actual results: Error: Problem 1: conflicting requests - nothing provides mvn(org.springframework:spring-context) needed by thredds-tdm-4.6.2-10.fc31.noarch - nothing provides mvn(org.springframework:spring-core) needed by thredds-tdm-4.6.2-10.fc31.noarch Problem 2: conflicting requests - nothing provides mvn(org.springframework:spring-core) needed by thredds-tdcommon-4.6.2-10.fc31.noarch Problem 3: conflicting requests - nothing provides mvn(org.springframework:spring-context) needed by thredds-dap-4.6.2-10.fc31.noarch - nothing provides mvn(org.springframework:spring-web) needed by thredds-dap-4.6.2-10.fc31.noarch Expected results: The packages should be installed. -- You are receiving this mail because: You are on the CC list for the bug.

1 2

← Newer
1
...
12
13
14
15
16
17
18
...
39
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits June 2020