December 2023 - java-sig-commits - Fedora Mailing-Lists

[Bug 1801149] New: CVE-2019-13990 libquartz-java: XXE attacks via job description

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1801149 Bug ID: 1801149 Summary: CVE-2019-13990 libquartz-java: XXE attacks via job description Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: darunesh(a)redhat.com CC: agrimm(a)gmail.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, bbuckingham(a)redhat.com, bcourt(a)redhat.com, bkearney(a)redhat.com, btotty(a)redhat.com, chazlett(a)redhat.com, dblechte(a)redhat.com, dfediuck(a)redhat.com, drieden(a)redhat.com, eedri(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gvarsami(a)redhat.com, hhudgeon(a)redhat.com, ibek(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jochrist(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, ldimaggi(a)redhat.com, lef(a)fedoraproject.org, lzap(a)redhat.com, mgoldboi(a)redhat.com, michal.skrivanek(a)redhat.com, mmccune(a)redhat.com, mnovotny(a)redhat.com, nwallace(a)redhat.com, paradhya(a)redhat.com, pjindal(a)redhat.com, puntogil(a)libero.it, rchan(a)redhat.com, rjerrido(a)redhat.com, rrajasek(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbonazzo(a)redhat.com, sdaley(a)redhat.com, sherold(a)redhat.com, sokeeffe(a)redhat.com, tbrisker(a)redhat.com, tcunning(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, yturgema(a)redhat.com Target Milestone: --- Classification: Other A vulnerability was found in initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description. Reference: https://github.com/quartz-scheduler/quartz/issues/467 https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115a... https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432d... https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679... https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046... https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3... -- You are receiving this mail because: You are on the CC list for the bug.

3 months, 2 weeks

1
27
0 / 0

[Bug 2242758] New: mojo-parent-77 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2242758 Bug ID: 2242758 Summary: mojo-parent-77 is available Product: Fedora Version: rawhide Status: NEW Component: mojo-parent Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 77 Upstream release that is considered latest: 77 Current version/release in rawhide: 76-2.fc40 URL: http://www.mojohaus.org/mojo-parent/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release... Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/2005/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/mojo-parent -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2242758 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

3 months, 2 weeks

1
5
0 / 0

[Bug 2245742] New: maven-dependency-plugin-3.6.1 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2245742 Bug ID: 2245742 Summary: maven-dependency-plugin-3.6.1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-dependency-plugin Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.6.1 Upstream release that is considered latest: 3.6.1 Current version/release in rawhide: 3.6.0-2.fc40 URL: http://maven.apache.org/plugins/maven-dependency-plugin/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release... Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1902/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/maven-dependency-plugin -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2245742 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

3 months, 2 weeks

1
4
0 / 0

[Bug 2245359] New: jsoup-1.16.2 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2245359 Bug ID: 2245359 Summary: jsoup-1.16.2 is available Product: Fedora Version: rawhide Status: NEW Component: jsoup Keywords: FutureFeature, Triaged Assignee: extras-orphan(a)fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, mkoncek(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 1.16.2 Upstream release that is considered latest: 1.16.2 Current version/release in rawhide: 1.16.1-2.fc40 URL: https://jsoup.org/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release... Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1479/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/jsoup -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2245359 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

3 months, 2 weeks

1
6
0 / 0

[Bug 2238239] New: maven-enforcer-3.4.1 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2238239 Bug ID: 2238239 Summary: maven-enforcer-3.4.1 is available Product: Fedora Version: rawhide Status: NEW Component: maven-enforcer Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 3.4.1 Upstream release that is considered latest: 3.4.1 Current version/release in rawhide: 3.4.0-2.fc40 URL: http://maven.apache.org/enforcer/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release... Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/1909/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/maven-enforcer -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2238239 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

3 months, 2 weeks

1
4
0 / 0

[Bug 2241426] New: apache-commons-io-2.14.0 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2241426 Bug ID: 2241426 Summary: apache-commons-io-2.14.0 is available Product: Fedora Version: rawhide Status: NEW Component: apache-commons-io Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com, stuart(a)gathman.org Target Milestone: --- Classification: Fedora Releases retrieved: 2.14.0 Upstream release that is considered latest: 2.14.0 Current version/release in rawhide: 2.13.0-4.fc40 URL: http://www.apache.org/dist/commons/io/source/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release... Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/72/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/apache-commons-io -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2241426 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

3 months, 2 weeks

1
4
0 / 0

[Bug 2245491] New: plexus-cipher-2.1.0 is available

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2245491 Bug ID: 2245491 Summary: plexus-cipher-2.1.0 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-cipher Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: huwang(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 2.1.0 Upstream release that is considered latest: 2.1.0 Current version/release in rawhide: 2.0-7.fc40 URL: https://github.com/codehaus-plexus/plexus-cipher Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release... Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/3657/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/plexus-cipher -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2245491 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

3 months, 2 weeks

1
2
0 / 0

[Bug 2171439] New: apache-commons-net: FTBFS in Fedora rawhide/f38

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2171439 Bug ID: 2171439 Summary: apache-commons-net: FTBFS in Fedora rawhide/f38 Product: Fedora Version: rawhide Status: NEW Component: apache-commons-net Assignee: luis(a)blackfile.net Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, luis(a)blackfile.net, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com Blocks: 2117176 (F38FTBFS) Target Milestone: --- Classification: Fedora apache-commons-net failed to build from source in Fedora rawhide/f38 https://koji.fedoraproject.org/koji/taskinfo?taskID=96310506 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Please fix apache-commons-net at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, apache-commons-net will be orphaned. Before branching of Fedora 39, apache-commons-net will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fai... Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2117176 [Bug 2117176] Fedora 38 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2171439

3 months, 2 weeks

1
2
0 / 0

[Bug 2252980] New: F40FailsToInstall: apache-commons-modeler

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2252980 Bug ID: 2252980 Summary: F40FailsToInstall: apache-commons-modeler Product: Fedora Version: rawhide Status: NEW Component: apache-commons-modeler Assignee: SpikeFedora(a)gmail.com Reporter: fti-bugs(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, SpikeFedora(a)gmail.com Blocks: 2231790 (F40FailsToInstall,RAWHIDEFailsToInstall) Target Milestone: --- Classification: Fedora Hello, Please note that this comment was generated automatically by https://pagure.io/releng/blob/main/f/scripts/ftbfs-fti/follow-policy.py If you feel that this output has mistakes, please open an issue at https://pagure.io/releng/ Your package (apache-commons-modeler) Fails To Install in Fedora 40: can't install apache-commons-modeler: - nothing provides mvn(commons-logging:commons-logging-api) needed by apache-commons-modeler-2.0.1-36.fc39.noarch If you know about this problem and are planning on fixing it, please acknowledge so by setting the bug status to ASSIGNED. If you don't have time to maintain this package, consider orphaning it, so maintainers of dependent packages realize the problem. If you don't react accordingly to the policy for FTBFS/FTI bugs (https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fai...), your package may be orphaned in 8+ weeks. P.S. The data was generated solely from koji buildroot, so it might be newer than the latest compose or the content on mirrors. To reproduce, use the koji/local repo only, e.g. in mock: $ mock -r fedora-40-x86_64 --config-opts mirrored=False install apache-commons-modeler P.P.S. If this bug has been reported in the middle of upgrading multiple dependent packages, please consider using side tags: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/#updating-inter... Thanks! Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2231790 [Bug 2231790] Fedora 40 Fails To install Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2252980 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-...

3 months, 2 weeks

1
7
0 / 0

[Bug 2171438] New: apache-commons-lang3: FTBFS in Fedora rawhide/f38

by bugzilla＠redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2171438 Bug ID: 2171438 Summary: apache-commons-lang3: FTBFS in Fedora rawhide/f38 Product: Fedora Version: rawhide Status: NEW Component: apache-commons-lang3 Assignee: stuart(a)gathman.org Reporter: releng(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, stuart(a)gathman.org Blocks: 2117176 (F38FTBFS) Target Milestone: --- Classification: Fedora apache-commons-lang3 failed to build from source in Fedora rawhide/f38 https://koji.fedoraproject.org/koji/taskinfo?taskID=96310469 For details on the mass rebuild see: https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Please fix apache-commons-lang3 at your earliest convenience and set the bug's status to ASSIGNED when you start fixing it. If the bug remains in NEW state for 8 weeks, apache-commons-lang3 will be orphaned. Before branching of Fedora 39, apache-commons-lang3 will be retired, if it still fails to build. For more details on the FTBFS policy, please visit: https://docs.fedoraproject.org/en-US/fesco/Fails_to_build_from_source_Fai... Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2117176 [Bug 2117176] Fedora 38 FTBFS Tracker -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2171438

3 months, 2 weeks

1
1
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits December 2023