October 2022 - java-sig-commits - Fedora Mailing-Lists

[Bug 2134291] New: CVE-2022-40152 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2134291 Bug ID: 2134291 Summary: CVE-2022-40152 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: pdelbell(a)redhat.com CC: didiksupriadi41(a)gmail.com, fedoraproject.org(a)bluhm-de.com, java-sig-commits(a)lists.fedoraproject.org, lkundrak(a)v3.sk, mizdebsk(a)redhat.com Blocks: 2128414 Target Milestone: --- Classification: Other Those using Xstream to serialize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434 https://github.com/x-stream/xstream/issues/304 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2134291

8 months, 4 weeks

1
29
0 / 0

[Bug 2134991] New: easymock-5.0.0 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2134991 Bug ID: 2134991 Summary: easymock-5.0.0 is available Product: Fedora Version: rawhide Status: NEW Component: easymock Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, fnasser(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 5.0.0 Upstream release that is considered latest: 5.0.0 Current version/release in rawhide: 4.3-1.fc38 URL: http://www.easymock.org Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release... Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/649/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/easymock -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2134991

9 months, 1 week

1
4
0 / 0

[Bug 2129818] New: snakeyaml-1.33 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2129818 Bug ID: 2129818 Summary: snakeyaml-1.33 is available Product: Fedora Version: rawhide Status: NEW Component: snakeyaml Keywords: FutureFeature, Triaged Assignee: jerboaa(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: fedoraproject.org(a)bluhm-de.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, mizdebsk(a)redhat.com, mo(a)morsi.org Target Milestone: --- Classification: Fedora Releases retrieved: 1.33 Upstream release that is considered latest: 1.33 Current version/release in rawhide: 1.32-1.fc38 URL: https://bitbucket.org/asomov/snakeyaml/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/4842/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/snakeyaml -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2129818

9 months, 1 week

1
3
0 / 0

[Bug 1694474] New: velocity-2.1 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1694474 Bug ID: 1694474 Summary: velocity-2.1 is available Product: Fedora Version: rawhide Status: NEW Component: velocity Keywords: FutureFeature, Triaged Assignee: mhroncok(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, devrim(a)gunduz.org, java-sig-commits(a)lists.fedoraproject.org, mhroncok(a)redhat.com, mizdebsk(a)redhat.com, sochotni(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 2.1 Current version/release in rawhide: 1.7-25.fc30 URL: http://www.apache.org/dist/velocity/engine/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/5083/ -- You are receiving this mail because: You are on the CC list for the bug.

9 months, 1 week

1
5
0 / 0

[Bug 2068302] New: maven-verifier-1.8.0 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2068302 Bug ID: 2068302 Summary: maven-verifier-1.8.0 is available Product: Fedora Version: rawhide Status: NEW Component: maven-verifier Keywords: FutureFeature, Triaged Assignee: extras-orphan(a)fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 1.8.0 Current version/release in rawhide: 1.7.2-8.fc36 URL: http://maven.apache.org/shared/maven-verifier/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1923/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2068302

9 months, 1 week

1
2
0 / 0

[Bug 1720601] New: javapackages-tools-5.3.1 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1720601 Bug ID: 1720601 Summary: javapackages-tools-5.3.1 is available Product: Fedora Version: rawhide Status: NEW Component: javapackages-tools Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, sochotni(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 5.3.1 Current version/release in rawhide: 5.3.0-4.fc30 URL: https://github.com/fedora-java/javapackages Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/15556/ -- You are receiving this mail because: You are on the CC list for the bug.

9 months, 1 week

1
3
0 / 0

[Bug 1933910] New: apache-commons-lang3-3.12.0 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1933910 Bug ID: 1933910 Summary: apache-commons-lang3-3.12.0 is available Product: Fedora Version: rawhide Status: NEW Component: apache-commons-lang3 Keywords: FutureFeature, Triaged Assignee: stuart(a)gathman.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, stuart(a)gathman.org Target Milestone: --- Classification: Fedora Latest upstream release: 3.12.0 Current version/release in rawhide: 3.11-2.fc34 URL: http://archive.apache.org/dist/commons/lang/source/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/76/ -- You are receiving this mail because: You are on the CC list for the bug.

9 months, 1 week

1
2
0 / 0

[Bug 1688070] New: takari-incrementalbuild-0.20.9 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1688070 Bug ID: 1688070 Summary: takari-incrementalbuild-0.20.9 is available Product: Fedora Version: rawhide Status: NEW Component: takari-incrementalbuild Keywords: FutureFeature, Triaged Assignee: extras-orphan(a)fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dingyichen(a)gmail.com, extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 0.20.9 Current version/release in rawhide: 0.20.7-3.fc30 URL: http://takari.io Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/9579/ -- You are receiving this mail because: You are on the CC list for the bug.

9 months, 1 week

1
1
0 / 0

[Bug 2129085] New: batik-1.15 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2129085 Bug ID: 2129085 Summary: batik-1.15 is available Product: Fedora Version: rawhide Status: NEW Component: batik Keywords: FutureFeature, Triaged Assignee: mat.booth(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com, mat.booth(a)gmail.com, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 1.15 Upstream release that is considered latest: 1.15 Current version/release in rawhide: 1.14-7.fc37 URL: https://xmlgraphics.apache.org/batik/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/168/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/batik -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2129085

9 months, 2 weeks

1
3
0 / 0

[Bug 2137288] New: maven-4.0.0-alpha-2 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2137288 Bug ID: 2137288 Summary: maven-4.0.0-alpha-2 is available Product: Fedora Version: rawhide Status: NEW Component: maven Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msrb(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 4.0.0-alpha-2 Upstream release that is considered latest: 4.0.0-alpha-2 Current version/release in rawhide: 3.8.6-2.fc38 URL: https://maven.apache.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release... Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1894/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/maven -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2137288

9 months, 2 weeks

1
5
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits October 2022