java-sig-commits March 2021

java-sig-commits@lists.fedoraproject.org

1 participants
272 discussions

[Bug 1902827] New: CVE-2020-27218 jetty: buffer not correctly recycled in Gzip Request inflation [fedora-all]
by bugzilla＠redhat.com 21 Apr '21

21 Apr '21

https://bugzilla.redhat.com/show_bug.cgi?id=1902827 Bug ID: 1902827 Summary: CVE-2020-27218 jetty: buffer not correctly recycled in Gzip Request inflation [fedora-all] Product: Fedora Version: 33 Status: NEW Component: jetty Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: mat.booth(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jjohnstn(a)redhat.com, krzysztof.daniel(a)gmail.com, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, sochotni(a)redhat.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1837444] New: CVE-2020-1945 ant: insecure temporary file vulnerability
by bugzilla＠redhat.com 29 Mar '21

29 Mar '21

https://bugzilla.redhat.com/show_bug.cgi?id=1837444 Bug ID: 1837444 Summary: CVE-2020-1945 ant: insecure temporary file vulnerability Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, bbaranow(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, darran.lofthouse(a)redhat.com, decathorpe(a)gmail.com, dkreling(a)redhat.com, dmoluguw(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, gvarsami(a)redhat.com, hvyas(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, jaromir.capik(a)email.cz, java-maint(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jburrell(a)redhat.com, jcoleman(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jperkins(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, loleary(a)redhat.com, mizdebsk(a)redhat.com, mnovotny(a)redhat.com, msochure(a)redhat.com, msrb(a)redhat.com, msvehla(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pcheung(a)redhat.com, pdrozd(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puebele(a)redhat.com, rguimara(a)redhat.com, rrajasek(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sdaley(a)redhat.com, smaestri(a)redhat.com, spinder(a)redhat.com, sponnaga(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org, sthorger(a)redhat.com, swoodman(a)redhat.com, tcunning(a)redhat.com, theute(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, vbellur(a)redhat.com, vhalbert(a)redhat.com Target Milestone: --- Classification: Other Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process. References: https://issues.apache.org/jira/browse/RAT-269?page=com.atlassian.jira.plugi… https://lists.apache.org/thread.html/r8e592bbfc016a5dbe2a8c0e81ff99682b9c78… -- You are receiving this mail because: You are on the CC list for the bug.

1 31

[Bug 1879042] CVE-2020-25633 resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling
by bugzilla＠redhat.com 29 Mar '21

29 Mar '21

https://bugzilla.redhat.com/show_bug.cgi?id=1879042 --- Comment #22 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat build of Quarkus Via RHSA-2021:1004 https://access.redhat.com/errata/RHSA-2021:1004 -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1847093] New: antrl3 mock build requires antrl3-tools, which is built by... antlr3.
by bugzilla＠redhat.com 26 Mar '21

26 Mar '21

https://bugzilla.redhat.com/show_bug.cgi?id=1847093 Bug ID: 1847093 Summary: antrl3 mock build requires antrl3-tools, which is built by... antlr3. Product: Fedora Version: 32 Status: NEW Component: antlr3 Severity: high Assignee: loganjerry(a)gmail.com Reporter: gilboad(a)gmail.com QA Contact: extras-qa(a)fedoraproject.org CC: dingyichen(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, loganjerry(a)gmail.com, mizdebsk(a)redhat.com, walters(a)redhat.com Target Milestone: --- Classification: Fedora Description of problem: I'm trying to build antrl3 under CentOS 8. While trying to slowly build the dependency chain I noticed a BuildRequires: mvn(org.antlr:antlr3-maven-plugin) which is met by installing (under Fedora 32) antlr3-tools. Checking the source of antrl3-tools, I noticed its being built by antlr3.src.rpm. BTW, the same issue can be found in stringtemplate4, which is required by antlr3 build, but itself requires antrl3-tools. Version-Release number of selected component (if applicable): antlr3-3.5.2-25.fc32.src.rpm How reproducible: Always. Packages: A. antlr3: $ mock -r fedora-32-x86_64 antlr3-3.5.2-27.fc32.src.rpm ... Installing: ant noarch 1.10.8-1.fc32 updates 164 k <---------------------------------------------------------> antlr3-tool noarch 1:3.5.2-27.fc32 updates 1.1 M <---------------------------------------------------------> autoconf noarch 2.69-33.fc32 fedora 666 k automake noarch 1.16.1-14.fc32 fedora 665 k doxygen x86_64 1:1.8.17-2.fc32 fedora 4.8 M graphviz x86_64 2.42.4-1.fc32 fedora 3.4 M libtool x86_64 2.4.6-33.fc32 fedora 579 k maven-lib noarch 1:3.6.1-5.fc32 fedora 1.4 M maven-local noarch 5.3.0-9.fc32 fedora 8.7 k maven-plugin-bundle noarch 3.5.1-4.fc32 fedora 201 k maven-plugin-plugin noarch 3.5.1-7.fc32 fedora 61 k maven-project noarch 2.2.1-63.fc32 fedora 155 k plexus-compiler noarch 2.8.5-2.fc32 fedora 65 k sonatype-oss-parent noarch 7-19.fc32 fedora 13 k stringtemplate noarch 3.2.1-21.fc32 fedora 134 k <---------------------------------------------------------> stringtemplate4 noarch 4.3-2.fc32 fedora 247 k <---------------------------------------------------------> ... Wrote: /builddir/build/RPMS/antlr3-java-3.5.2-27.fc32.noarch.rpm Wrote: /builddir/build/RPMS/antlr3-C-3.4-3.5.2.27.fc32.x86_64.rpm Wrote: /builddir/build/RPMS/antlr3-javascript-3.1-3.5.2.27.fc32.noarch.rpm Wrote: /builddir/build/RPMS/antlr3-C-debuginfo-3.4-3.5.2.27.fc32.x86_64.rpm Wrote: /builddir/build/RPMS/antlr3-C++-devel-3.5.2-27.fc32.x86_64.rpm <---------------------------------------------------------> Wrote: /builddir/build/RPMS/antlr3-tool-3.5.2-27.fc32.noarch.rpm <---------------------------------------------------------> Wrote: /builddir/build/RPMS/antlr3-C-devel-3.4-3.5.2.27.fc32.x86_64.rpm Wrote: /builddir/build/RPMS/antlr3-debugsource-3.5.2-27.fc32.x86_64.rpm B. stringtemplate4: $ mock -r fedora-32-x86_64 stringtemplate4-4.3-2.fc32.src.rpm ... Installing: antlr3-java noarch 1:3.5.2-27.fc32 updates 160 k <---------------------------------------------------------> antlr3-tool noarch 1:3.5.2-27.fc32 updates 1.1 M <---------------------------------------------------------> junit noarch 1:4.12-13.fc32 fedora 283 k maven-local noarch 5.3.0-9.fc32 fedora 8.7 k sonatype-oss-parent noarch 7-19.fc32 fedora 13 k xorg-x11-fonts-Type1 noarch 7.5-24.fc32 fedora 500 k xorg-x11-server-Xvfb x86_64 1.20.8-1.fc32 fedora 879 k ... -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1372124] CVE-2016-6347 RESTEasy: Use of the default exception handler in RESTEasy can lead to reflected XSS attack
by bugzilla＠redhat.com 24 Mar '21

24 Mar '21

https://bugzilla.redhat.com/show_bug.cgi?id=1372124 Cedric Buissart <cbuissar(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |NEW Resolution|CURRENTRELEASE |--- Keywords| |Reopened -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1935927] CVE-2021-20289 resteasy: Error message exposes endpoint class information
by bugzilla＠redhat.com 22 Mar '21

22 Mar '21

https://bugzilla.redhat.com/show_bug.cgi?id=1935927 --- Comment #11 from Riccardo Schirone <rschiron(a)redhat.com> --- Created resteasy tracking bugs for this issue: Affects: fedora-all [bug 1941544] -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1935927] CVE-2021-20289 resteasy: Error message exposes endpoint class information
by bugzilla＠redhat.com 22 Mar '21

22 Mar '21

https://bugzilla.redhat.com/show_bug.cgi?id=1935927 Riccardo Schirone <rschiron(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1941545, 1941546, 1941544 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1941544 [Bug 1941544] CVE-2021-20289 resteasy: Error message exposes endpoint class information [fedora-all] -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1935927] CVE-2021-20289 resteasy: Error message exposes endpoint class information
by bugzilla＠redhat.com 21 Mar '21

21 Mar '21

https://bugzilla.redhat.com/show_bug.cgi?id=1935927 --- Comment #10 from Ted (Jong Seok) Won <jwon(a)redhat.com> --- Acknowledgments: Name: Dirk Papenberg (NTT DATA Germany) -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1886869] New: felix-gogo-runtime-1.1.4 is available
by bugzilla＠redhat.com 19 Mar '21

19 Mar '21

https://bugzilla.redhat.com/show_bug.cgi?id=1886869 Bug ID: 1886869 Summary: felix-gogo-runtime-1.1.4 is available Product: Fedora Version: rawhide Status: NEW Component: felix-gogo-runtime Keywords: FutureFeature, Triaged Assignee: akurtako(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 1.1.4 Current version/release in rawhide: 1.1.0-8.fc33 URL: http://felix.apache.org/documentation/subprojects/apache-felix-gogo.html Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/9729/ -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1886867] New: felix-gogo-shell-1.1.4 is available
by bugzilla＠redhat.com 19 Mar '21

19 Mar '21

https://bugzilla.redhat.com/show_bug.cgi?id=1886867 Bug ID: 1886867 Summary: felix-gogo-shell-1.1.4 is available Product: Fedora Version: rawhide Status: NEW Component: felix-gogo-shell Keywords: FutureFeature, Triaged Assignee: akurtako(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 1.1.4 Current version/release in rawhide: 1.1.0-6.fc33 URL: http://felix.apache.org/documentation/subprojects/apache-felix-gogo.html Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/9729/ -- You are receiving this mail because: You are on the CC list for the bug.

1 12

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits March 2021