java-sig-commits March 2020

java-sig-commits@lists.fedoraproject.org

1 participants
410 discussions

[Bug 1782296] New: plexus-pom-6.0 is available
by bugzilla＠redhat.com 04 Mar '20

04 Mar '20

https://bugzilla.redhat.com/show_bug.cgi?id=1782296 Bug ID: 1782296 Summary: plexus-pom-6.0 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-pom Keywords: FutureFeature, Triaged Assignee: decathorpe(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, puntogil(a)libero.it, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 6.0 Current version/release in rawhide: 5.1-1.fc32 URL: https://github.com/codehaus-plexus/plexus-pom Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/20412/ -- You are receiving this mail because: You are on the CC list for the bug.

1 6

[Bug 1782284] New: woodstox-core-6.0.3 is available
by bugzilla＠redhat.com 04 Mar '20

04 Mar '20

https://bugzilla.redhat.com/show_bug.cgi?id=1782284 Bug ID: 1782284 Summary: woodstox-core-6.0.3 is available Product: Fedora Version: rawhide Status: NEW Component: woodstox-core Keywords: FutureFeature, Triaged Assignee: decathorpe(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 6.0.3 Current version/release in rawhide: 6.0.2-1.fc32 URL: https://github.com/FasterXML/woodstox Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/5140/ -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1808641] New: log4j-2.13.1 is available
by bugzilla＠redhat.com 04 Mar '20

04 Mar '20

https://bugzilla.redhat.com/show_bug.cgi?id=1808641 Bug ID: 1808641 Summary: log4j-2.13.1 is available Product: Fedora Version: rawhide Status: NEW Component: log4j Keywords: FutureFeature, Triaged Assignee: decathorpe(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, decathorpe(a)gmail.com, devrim(a)gunduz.org, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, sochotni(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 2.13.1 Current version/release in rawhide: 2.13.0-3.fc33 URL: http://www.apache.org/dist/logging/log4j Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1836/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1808753] New: plexus-archiver-4.2.2 is available
by bugzilla＠redhat.com 04 Mar '20

04 Mar '20

https://bugzilla.redhat.com/show_bug.cgi?id=1808753 Bug ID: 1808753 Summary: plexus-archiver-4.2.2 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-archiver Keywords: FutureFeature, Triaged Assignee: stewardship-sig(a)lists.fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, decathorpe(a)gmail.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, mhroncok(a)redhat.com, mizdebsk(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 4.2.2 Current version/release in rawhide: 4.2.1-2.fc32 URL: http://codehaus-plexus.github.io/plexus-archiver Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/3655/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1806398] CVE-2020-1938 tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability
by bugzilla＠redhat.com 01 Mar '20

01 Mar '20

https://bugzilla.redhat.com/show_bug.cgi?id=1806398 --- Comment #71 from Ted (Jong Seok) Won <jwon(a)redhat.com> --- Mitigation: The issue can be mitigated as follows: For JWS(Tomcat), If your site is not actively using the AJP Connector, simply comment it out from the <TOMCAT_HOME>/conf/server.xml file as ~~~  ~~~ If AJP connector is required and cannot be commented/deactivated, then we recommend to set a secret password for the AJP conduit - Only requests from workers with the same secret keyword will be accepted. At the Tomcat side, edit conf/server.xml: ~~~ <Connector port = "8009" protocol = "AJP / 1.3" redirectPort = "8443" address = "YOUR_TOMCAT_IP_ADDRESS" requiredSecret = "YOUR_AJP_SECRET" /> ~~~ For JBoss EAP 6.4 (JBossWeb 7.x), The AJP connector is enabled by default only in standalone-full-ha.xml, standalone-ha.xml and ha and full-ha profiles in domain.xml. AJP connector can be secured as follows: If you do not use AJP, you can disable the AJP port configuration in your standalone-*.xml and/or domain.xml file by setting enabled="false" as shown below or comment out the whole <connector name="AJP" .../> clause: ~~~ <connector name="AJP" protocol="AJP/1.3" scheme="http" socket-binding="ajp" enabled="false"/> ~~~ If AJP connector is a requirement and cannot be commented or deactivated, then, it is recommended to add credential to AJP connector by configuring the following system property. ~~~ <system-properties> <property name="org.apache.coyote.ajp.DEFAULT_REQUIRED_SECRET" value="YOUR_AJP_SECRET"/> </system-properties> ~~~ Note that YOUR_AJP_SECRET must be changed to a value that is highly secure and cannot be easily guessed. For Apache httpd (httpd in JBCS or RHEL), When the above setting is configured, the same secret value on the front-end proxy (mod_proxy or mod_jk) will be required to be configured. * mod_proxy (mod_proxy_ajp / mod_proxy_balancer using ajp) The secret property support was added since JBCS httpd 2.4.37 or since RHEL 7 httpd-2.4.6-67.el7.x86_641.[1] For mod_proxy_ajp, the secret property can be added to ProxyPass setting. For mod_proxy_balancer, the secret property can be added to each BalancerMember setting. For example, add secret=YOUR_AJP_SECRET in your configuration (e.g. <HTTPD_HOME>/conf/httpd.conf or <HTTPD_HOME>/conf.d/proxy_ajp.conf) like the following: - mod_proxy_ajp: ~~~ ProxyPass /example/ ajp://localhost:8009/example/ secret=YOUR_AJP_SECRET ~~~ - mod_proxy_balancer: ~~~ <Proxy balancer://mycluster> BalancerMember ajp://node1:8009 route=node1 secret=YOUR_AJP_SECRET BalancerMember ajp://node2:8009 route=node2 secret=YOUR_AJP_SECRET </Proxy> ProxyPass /example/ balancer://mycluster/example/ stickysession=JSESSIONID|jsessionid ~~~ * mod_jk mod_jk - secret can be specified to a worker or a load balancer in workers.properties. If you set a secret on a load balancer, all its members will inherit this secret. This secret property support was added in mod_jk 1.2.12 onwards. For example, add the following in your workers.properties: ~~~ worker.<WORKER_NAME>.secret=YOUR_AJP_SECRET ~~~ Ensure that WORKER_NAME must be replaced with the appropriate name. * mod_cluster mod_cluster does not support secret property.[2] When secret is configured on the AJP connector in Tomcat/JBoss side, you can not connect AJP without a correct secret value. So, you need to use http or https for mod_cluster. [1] https://bugzilla.redhat.com/show_bug.cgi?id=1397241 [2] https://docs.modcluster.io/#migration-from-modjk -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1803416] New: plexus-compiler-2.8.6 is available
by bugzilla＠redhat.com 01 Mar '20

01 Mar '20

https://bugzilla.redhat.com/show_bug.cgi?id=1803416 Bug ID: 1803416 Summary: plexus-compiler-2.8.6 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-compiler Keywords: FutureFeature, Triaged Assignee: stewardship-sig(a)lists.fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: dbhole(a)redhat.com, decathorpe(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, sochotni(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 2.8.6 Current version/release in rawhide: 2.8.5-2.fc32 URL: https://github.com/codehaus-plexus/plexus-compiler Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/9003/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1801796] New: weld-parent-40 is available
by bugzilla＠redhat.com 01 Mar '20

01 Mar '20

https://bugzilla.redhat.com/show_bug.cgi?id=1801796 Bug ID: 1801796 Summary: weld-parent-40 is available Product: Fedora Version: rawhide Status: NEW Component: weld-parent Keywords: FutureFeature, Triaged Assignee: decathorpe(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 40 Current version/release in rawhide: 39-2.fc32 URL: http://weld.cdi-spec.org Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/20402/ -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1793372] New: plexus-components-pom-6.1 is available
by bugzilla＠redhat.com 01 Mar '20

01 Mar '20

https://bugzilla.redhat.com/show_bug.cgi?id=1793372 Bug ID: 1793372 Summary: plexus-components-pom-6.1 is available Product: Fedora Version: rawhide Status: NEW Component: plexus-components-pom Keywords: FutureFeature, Triaged Assignee: stewardship-sig(a)lists.fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, mhroncok(a)redhat.com, mizdebsk(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 6.1 Current version/release in rawhide: 4.0-1.fc32 URL: https://github.com/codehaus-plexus/plexus-components Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/9005/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1782272] New: qdox-2.0.0 is available
by bugzilla＠redhat.com 01 Mar '20

01 Mar '20

https://bugzilla.redhat.com/show_bug.cgi?id=1782272 Bug ID: 1782272 Summary: qdox-2.0.0 is available Product: Fedora Version: rawhide Status: NEW Component: qdox Keywords: FutureFeature, Triaged Assignee: stewardship-sig(a)lists.fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, decathorpe(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, mhroncok(a)redhat.com, mizdebsk(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 2.0.0 Current version/release in rawhide: 2.0-7.M9.fc32 URL: https://github.com/paul-hammant/qdox Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/12832/ -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1769139] New: sisu-0.3.4 is available
by bugzilla＠redhat.com 01 Mar '20

01 Mar '20

https://bugzilla.redhat.com/show_bug.cgi?id=1769139 Bug ID: 1769139 Summary: sisu-0.3.4 is available Product: Fedora Version: rawhide Status: NEW Component: sisu Keywords: FutureFeature, Triaged Assignee: stewardship-sig(a)lists.fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, eclipse-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, mhroncok(a)redhat.com, mizdebsk(a)redhat.com, sochotni(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 0.3.4 Current version/release in rawhide: 0.3.3-8.fc31 URL: http://eclipse.org/sisu Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/20407/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits March 2020