March 2022 - java-sig-commits - Fedora Mailing-Lists

[Bug 2061424] New: Update to tomcat-9.0.59 breaks CA installation in IPA

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2061424 Bug ID: 2061424 Summary: Update to tomcat-9.0.59 breaks CA installation in IPA Product: Fedora Version: rawhide Status: NEW Component: tomcat Severity: urgent Assignee: csutherl(a)redhat.com Reporter: ckelley(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, coolsvap(a)gmail.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com Target Milestone: --- Link ID: Red Hat Bugzilla 2047419 Classification: Fedora Description of problem: The recent update from tomcat-9.0.56 to tomcat-9.0.59 in Rawhide prevents CA installation in IPA. Reverting to 56 fixes the installation issue. ## Pull request that introduces this issue https://src.fedoraproject.org/rpms/tomcat/pull-request/8 ## More detail in the IPA/Dogtag issues raised for this https://pagure.io/freeipa/issue/9122 https://github.com/dogtagpki/pki/issues/3927 Version-Release number of selected component (if applicable): How reproducible: Very Steps to Reproduce: 1. See upstream issues or details 2. 3. Actual results: CA installation with IPA fails with latest Rawhide Expected results: CA installation with IPA succeeds with latest Rawhide Additional info: -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2061424

2 years, 2 months

1
8
0 / 0

[Bug 1129074] CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1129074 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2022:0055 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1129074

2 years, 2 months

1
0
0 / 0

[Bug 1129074] CVE-2014-3577 Apache HttpComponents client / Apache CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1129074 --- Comment #79 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.10 Via RHSA-2022:0055 https://access.redhat.com/errata/RHSA-2022:0055 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=1129074

2 years, 2 months

1
0
0 / 0

[Bug 1988028] New: tycho: FTBFS in Fedora rawhide/f35

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1988028 Bug ID: 1988028 Summary: tycho: FTBFS in Fedora rawhide/f35 Product: Fedora Version: rawhide Status: NEW Component: tycho Assignee: akurtako(a)redhat.com Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com, mat.booth(a)gmail.com, mizdebsk(a)redhat.com, rgrunber(a)redhat.com, sochotni(a)redhat.com Blocks: 1927309 (F35FTBFS,RAWHIDEFTBFS) Target Milestone: --- Classification: Fedora tycho failed to build from source in Fedora rawhide/f35 https://koji.fedoraproject.org/koji/taskinfo?taskID=72516669 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Please fix tycho at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, tycho will be orphaned. Before branching of Fedora 36, tycho will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fai... Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1927309 [Bug 1927309] Fedora 35 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug.

2 years, 2 months

1
7
0 / 0

[Bug 2057616] New: Please provide disruptor for EPEL-8

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2057616 Bug ID: 2057616 Summary: Please provide disruptor for EPEL-8 Product: Fedora EPEL Version: epel9 Status: NEW Component: disruptor Assignee: sergio(a)serjux.com Reporter: fedoraproject.org(a)bluhm-de.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, puntogil(a)libero.it, sergio(a)serjux.com Target Milestone: --- Classification: Fedora Can you please provide disruptor for EPEL-8? If you like, I can take this on. Just add me as contributor (FAS: sbluhm) EPEL-8 already builds with rawhide code: https://koji.fedoraproject.org/koji/taskinfo?taskID=83234588 Thank you. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2057616

2 years, 2 months

1
6
0 / 0

[Bug 2047419] New: CVE-2022-23181 tomcat: local privilege escalation vulnerability [fedora-all]

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2047419 Bug ID: 2047419 Summary: CVE-2022-23181 tomcat: local privilege escalation vulnerability [fedora-all] Product: Fedora Version: 35 Status: NEW Component: tomcat Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: csutherl(a)redhat.com Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: alee(a)redhat.com, coolsvap(a)gmail.com, csutherl(a)redhat.com, gzaronikas(a)gmail.com, huwang(a)redhat.com, ivan.afonichev(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, krzysztof.daniel(a)gmail.com Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2047419

2 years, 2 months

1
6
0 / 0

[Bug 1964408] New: google-gson-2.8.7 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1964408 Bug ID: 1964408 Summary: google-gson-2.8.7 is available Product: Fedora Version: rawhide Status: NEW Component: google-gson Keywords: FutureFeature, Triaged Assignee: java-maint-sig(a)lists.fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dchen(a)redhat.com, extras-orphan(a)fedoraproject.org, jaromir.capik(a)email.cz, java-maint-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com, lef(a)fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 2.8.7 Current version/release in rawhide: 2.8.6-8.fc34 URL: https://github.com/google/gson Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1232/ -- You are receiving this mail because: You are on the CC list for the bug.

2 years, 2 months

1
15
0 / 0

[Bug 2036061] no line information in gdb after linking a nasm object file with ld

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2036061 Nick Clifton <nickc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|binutils |nasm Assignee|nickc(a)redhat.com |dominik(a)greysector.net CC| |dominik(a)greysector.net, | |java-sig-commits(a)lists.fedo | |raproject.org, | |mizdebsk(a)redhat.com, | |pbonzini(a)redhat.com --- Comment #4 from Nick Clifton <nickc(a)redhat.com> --- Right - I have tracked the problem down to this commit: 2021-05-07 Jan Beulich <jbeulich(a)suse.com> * elf64-x86-64.c (x86_64_elf_howto_table): Set src_mask fields to zero. Which fixed a bug in the x86 linker's handling of RELA type relocations. These relocations are intended to have all the necessary information in the reloc itself, and do not take any data from the instruction being relocated. But the NASM assembler is creating RELA relocations with additional data in the instruction itself: % objdump -Dr hello.o [...] 0000000000000000 <.debug_info>: [...] 13: 00 2d 00 00 00 00 add %ch,0x0(%rip) # 19 <.debug_info+0x19> 14: R_X86_64_64 .text What NASM wants the relocation for bytes 14..17 to do is to take the the value stored there (0x0000002d), add in the address of the .text section (0x00401000) and store the result back into those bytes. And prior to the 2.37 release of the binutils this is what happened. But now that the bug has been fixed what the relocation actually does is to totally ignore the contents of bytes 14..17 and instead just install the address of the start of the .text section. Reassigning to NASM. What needs to happen, in my opnion, is for NASM to either create REL type relocs instead of RELA relocs, or else move the 0x0000002d value out of the .debug_info section and into the R_X86_64_64 reloc. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2036061

2 years, 2 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits March 2022