java-sig-commits April 2017

java-sig-commits@lists.fedoraproject.org

1 participants
217 discussions

[Bug 1329272] New: Could not find artifact org.gradle:gradle-base-services:jar:2.8 in mizdebsk-redhat (http://people.redhat.com/~mizdebsk/xmvn/repo/)
by Red Hat Bugzilla 11 Sep '17

11 Sep '17

https://bugzilla.redhat.com/show_bug.cgi?id=1329272 Bug ID: 1329272 Summary: Could not find artifact org.gradle:gradle-base-services:jar:2.8 in mizdebsk-redhat (http://people.redhat.com/~mizdebsk/xmvn/repo/) Product: Fedora Version: rawhide Component: xmvn Assignee: mizdebsk(a)redhat.com Reporter: matthias(a)mailaender.name QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Description of problem: I tried to build xmvn locally on openSUSE Tumbleweed. Version-Release number of selected component (if applicable): xmvn-2.5.0 Steps to Reproduce: mvn -B clean install [...] [INFO] XMvn Connector for Gradle .......................... FAILURE [ 5.718 s] [...] [ERROR] Failed to execute goal on project xmvn-connector-gradle: Could not resolve dependencies for project org.fedoraproject.xmvn:xmvn-connector-gradle:jar:2.5.0: The following artifacts could not be resolved: org.gradle:gradle-base-services:jar:2.8, org.gradle:gradle-base-services-groovy:jar:2.8, org.gradle:gradle-core:jar:2.8, org.gradle:gradle-dependency-management:jar:2.8, org.gradle:gradle-resources:jar:2.8: Could not find artifact org.gradle:gradle-base-services:jar:2.8 in mizdebsk-redhat (http://people.redhat.com/~mizdebsk/xmvn/repo/) -> [Help 1] -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1340441] New: joda-time-v2.9.4 is available
by Red Hat Bugzilla 11 Sep '17

11 Sep '17

https://bugzilla.redhat.com/show_bug.cgi?id=1340441 Bug ID: 1340441 Summary: joda-time-v2.9.4 is available Product: Fedora Version: rawhide Component: joda-time Keywords: FutureFeature, Triaged Assignee: SpikeFedora(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com, SpikeFedora(a)gmail.com Latest upstream release: v2.9.4 Current version/release in rawhide: 2.9.3-1.tzdata2016c.fc25 URL: https://github.com/JodaOrg/joda-time Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1466/ -- You are receiving this mail because: You are on the CC list for the bug.

2 22

[Bug 1423223] New: apache-commons-email: FTBFS in rawhide
by bugzilla＠redhat.com 22 Aug '17

22 Aug '17

https://bugzilla.redhat.com/show_bug.cgi?id=1423223 Bug ID: 1423223 Summary: apache-commons-email: FTBFS in rawhide Product: Fedora Version: rawhide Component: apache-commons-email Assignee: SpikeFedora(a)gmail.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, SpikeFedora(a)gmail.com Blocks: 1423041 Your package apache-commons-email failed to build from source in current rawhide. https://koji.fedoraproject.org/koji/taskinfo?taskID=17710140 For details on mass rebuild see https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1423041 [Bug 1423041] Fedora 26 Mass Rebuild FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1434522] New: CVE-2017-5644 apache-poi: XML entity expansion via specially crafted OOXML file
by bugzilla＠redhat.com 19 Aug '17

19 Aug '17

https://bugzilla.redhat.com/show_bug.cgi?id=1434522 Bug ID: 1434522 Summary: CVE-2017-5644 apache-poi: XML entity expansion via specially crafted OOXML file Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)redhat.com, puntogil(a)libero.it Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack. References: http://www.openwall.com/lists/oss-security/2017/03/20/9 -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1434523] New: CVE-2017-5644 apache-poi: XML entity expansion via specially crafted OOXML file [fedora-all]
by bugzilla＠redhat.com 19 Aug '17

19 Aug '17

https://bugzilla.redhat.com/show_bug.cgi?id=1434523 Bug ID: 1434523 Summary: CVE-2017-5644 apache-poi: XML entity expansion via specially crafted OOXML file [fedora-all] Product: Fedora Version: 25 Component: apache-poi Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: mat.booth(a)redhat.com Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)redhat.com, puntogil(a)libero.it This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1413505] New: CVE-2016-6814 groovy18: Apache Groovy: Information disclosure [fedora-all]
by Red Hat Bugzilla 18 Aug '17

18 Aug '17

https://bugzilla.redhat.com/show_bug.cgi?id=1413505 Bug ID: 1413505 Summary: CVE-2016-6814 groovy18: Apache Groovy: Information disclosure [fedora-all] Product: Fedora Version: 25 Component: groovy18 Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: puntogil(a)libero.it Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

2 12

[Bug 1397485] New: CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener
by Red Hat Bugzilla 16 Aug '17

16 Aug '17

https://bugzilla.redhat.com/show_bug.cgi?id=1397485 Bug ID: 1397485 Summary: CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: aileenc(a)redhat.com, alee(a)redhat.com, aszczucz(a)redhat.com, bbaranow(a)redhat.com, bdawidow(a)redhat.com, bgollahe(a)redhat.com, bmaxwell(a)redhat.com, ccoleman(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, csutherl(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, dosoudil(a)redhat.com, epp-bugs(a)redhat.com, felias(a)redhat.com, fnasser(a)redhat.com, gzaronik(a)redhat.com, hchiorea(a)redhat.com, hfnukal(a)redhat.com, hhorak(a)redhat.com, ivan.afonichev(a)gmail.com, jason.greene(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jboss-set(a)redhat.com, jclere(a)redhat.com, jcoleman(a)redhat.com, jdg-bugs(a)redhat.com, jdoyle(a)redhat.com, jgoulding(a)redhat.com, jialiu(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jorton(a)redhat.com, jpallich(a)redhat.com, jshepherd(a)redhat.com, kanderso(a)redhat.com, krzysztof.daniel(a)gmail.com, lgao(a)redhat.com, lmeyer(a)redhat.com, mbabacek(a)redhat.com, mbaluch(a)redhat.com, me(a)coolsvap.net, miburman(a)redhat.com, mizdebsk(a)redhat.com, mmccomas(a)redhat.com, mnewsome(a)redhat.com, mweiler(a)redhat.com, myarboro(a)redhat.com, nwallace(a)redhat.com, ohudlick(a)redhat.com, pavelp(a)redhat.com, pgier(a)redhat.com, psakar(a)redhat.com, pslavice(a)redhat.com, rnetuka(a)redhat.com, rsvoboda(a)redhat.com, rzima(a)redhat.com, spinder(a)redhat.com, theute(a)redhat.com, trick(a)vanstaveren.us, ttarrant(a)redhat.com, twalsh(a)redhat.com, vhalbert(a)redhat.com, vtunka(a)redhat.com, weli(a)redhat.com The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. Therefore, Tomcat installations using this listener remained vulnerable to a similar remote code execution vulnerability. This issue has been rated as important rather than critical due to the small number of installations using this listener and that it would be highly unusual for the JMX ports to be accessible to an attacker even when the listener is used. Affects: 6.0.0 to 6.0.47, 7.0.0 to 7.0.72, 8.0.0.RC1 to 8.0.38, 8.5.0 to 8.5.6 Upstream patches: Tomcat 6.0.48: https://svn.apache.org/viewvc?view=rev&rev=1767684 Tomcat 7.0.73: http://svn.apache.org/viewvc?view=rev&rev=1767676 Tomcat 8.0.39: http://svn.apache.org/viewvc?view=rev&rev=1767656 Tomcat 8.5.8: http://svn.apache.org/viewvc?view=rev&rev=1767646 External References: https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48 https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39 https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8 -- You are receiving this mail because: You are on the CC list for the bug.

2 35

[Bug 1378038] New: xmvn-install: Manifest injection skipped
by Red Hat Bugzilla 16 Aug '17

16 Aug '17

https://bugzilla.redhat.com/show_bug.cgi?id=1378038 Bug ID: 1378038 Summary: xmvn-install: Manifest injection skipped Product: Fedora Version: rawhide Component: xmvn Assignee: mizdebsk(a)redhat.com Reporter: msimacek(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, msimacek(a)redhat.com, msrb(a)redhat.com Description of problem: For some JAR files, manifest injection gets skipped, even though they have a manifest. From debug log: [TRACE] Manifest injection skipped: no pre-existing manifest found to update Version-Release number of selected component (if applicable): xmvn-install-2.5.0-15.fc26.noarch How reproducible: always Steps to Reproduce: 1. rebuild ecj package Actual results: Manifest injection doesn't happen. Expected results: Manifest is injected into all JARs. -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1409838] New: CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint
by Red Hat Bugzilla 10 Aug '17

10 Aug '17

https://bugzilla.redhat.com/show_bug.cgi?id=1409838 Bug ID: 1409838 Summary: CVE-2016-9879 Spring Security: Improper handling of path parameters allows bypassing the security constraint Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, bmcclain(a)redhat.com, chazlett(a)redhat.com, dblechte(a)redhat.com, dmcphers(a)redhat.com, eedri(a)redhat.com, gklein(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jialiu(a)redhat.com, jokerman(a)redhat.com, kseifried(a)redhat.com, lmeyer(a)redhat.com, lsurette(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mmccomas(a)redhat.com, puntogil(a)libero.it, rbalakri(a)redhat.com, Rhev-m-bugs(a)redhat.com, sbonazzo(a)redhat.com, sherold(a)redhat.com, srevivo(a)redhat.com, tiwillia(a)redhat.com, ydary(a)redhat.com, ykaul(a)redhat.com Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath() and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected. Mitigation: Use a Servlet container known not to include path parameters in the return values for getServletPath() and getPathInfo() Upstream bug: https://github.com/spring-projects/spring-security/issues/4169 External Reference: https://pivotal.io/security/cve-2016-9879 -- You are receiving this mail because: You are on the CC list for the bug.

2 8

[Bug 1380898] New: Spurious EOF error when reading build.sbt
by Red Hat Bugzilla 08 Aug '17

08 Aug '17

https://bugzilla.redhat.com/show_bug.cgi?id=1380898 Bug ID: 1380898 Summary: Spurious EOF error when reading build.sbt Product: Fedora Version: 24 Component: sbt Severity: medium Assignee: willb(a)redhat.com Reporter: greenrd(a)greenrd.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, s(a)shk.io, willb(a)redhat.com Description of problem: I get this error: build.sbt:272: error: ';' expected but eof found. val projectInfoFile = dir / "ProjectInfo.scala" ^ sbt.compiler.EvalException: Error parsing definition. Ensure that there are no blank lines within a definition. But the file build.sbt does not end on line 272! Version-Release number of selected component (if applicable): sbt-0.13.1-8.fc24.1.noarch How reproducible: Always Steps to Reproduce: Unfortunately this requires our proprietary source code, but maybe it can be reproduced by cloning another Scala repo and running sbt compile. Actual results: See above Expected results: Should build as it does on another machines (e.g. a Fedora 24 machine with the Lightbend sbt RPM installed). Additional info: project/build.properties contains: sbt.version=0.13.12 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

← Newer
1
...
12
13
14
15
16
17
18
...
22
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits April 2017