java-sig-commits August 2020

java-sig-commits@lists.fedoraproject.org

1 participants
453 discussions

[Bug 1801382] New: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation [epel-7]
by bugzilla＠redhat.com 08 Feb '22

08 Feb '22

https://bugzilla.redhat.com/show_bug.cgi?id=1801382 Bug ID: 1801382 Summary: CVE-2020-7226 cryptacular: excessive memory allocation during a decode operation [epel-7] Product: Fedora EPEL Version: epel7 Status: NEW Component: cryptacular Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: lef(a)fedoraproject.org Reporter: gsuckevi(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: extras-orphan(a)fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, puntogil(a)libero.it Target Milestone: --- Classification: Fedora This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of epel-7. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1720601] New: javapackages-tools-5.3.1 is available
by bugzilla＠redhat.com 07 Feb '22

07 Feb '22

https://bugzilla.redhat.com/show_bug.cgi?id=1720601 Bug ID: 1720601 Summary: javapackages-tools-5.3.1 is available Product: Fedora Version: rawhide Status: NEW Component: javapackages-tools Keywords: FutureFeature, Triaged Assignee: mizdebsk(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mat.booth(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, sochotni(a)redhat.com Target Milestone: --- Classification: Fedora Latest upstream release: 5.3.1 Current version/release in rawhide: 5.3.0-4.fc30 URL: https://github.com/fedora-java/javapackages Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/15556/ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1807472] New: jflex-1.8.0 is available
by bugzilla＠redhat.com 07 Feb '22

07 Feb '22

https://bugzilla.redhat.com/show_bug.cgi?id=1807472 Bug ID: 1807472 Summary: jflex-1.8.0 is available Product: Fedora Version: rawhide Status: NEW Component: jflex Keywords: FutureFeature, Triaged Assignee: stewardship-sig(a)lists.fedoraproject.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: akurtako(a)redhat.com, decathorpe(a)gmail.com, jaromir.capik(a)email.cz, java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 1.8.0 Current version/release in rawhide: 1.7.0-2.fc32 URL: http://jflex.de/download.html Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1449/ -- You are receiving this mail because: You are on the CC list for the bug.

1 10

[Bug 1694308] New: httpcomponents-client-4.5.8 is available
by bugzilla＠redhat.com 31 Jan '22

31 Jan '22

https://bugzilla.redhat.com/show_bug.cgi?id=1694308 Bug ID: 1694308 Summary: httpcomponents-client-4.5.8 is available Product: Fedora Version: rawhide Status: NEW Component: httpcomponents-client Keywords: FutureFeature, Triaged Assignee: stuart(a)gathman.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, jerboaa(a)gmail.com, krzysztof.daniel(a)gmail.com, mizdebsk(a)redhat.com, sochotni(a)redhat.com, stuart(a)gathman.org Target Milestone: --- Classification: Fedora Latest upstream release: 4.5.8 Current version/release in rawhide: 4.5.6-3.fc30 URL: http://www.apache.org/dist/httpcomponents/httpclient/source/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/1334/ -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1818177] New: xmlstreambuffer-2.0.0-M1 is available
by bugzilla＠redhat.com 17 Jan '22

17 Jan '22

https://bugzilla.redhat.com/show_bug.cgi?id=1818177 Bug ID: 1818177 Summary: xmlstreambuffer-2.0.0-M1 is available Product: Fedora Version: rawhide Status: NEW Component: xmlstreambuffer Keywords: FutureFeature, Triaged Assignee: decathorpe(a)gmail.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, puntogil(a)libero.it, stewardship-sig(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest upstream release: 2.0.0-M1 Current version/release in rawhide: 1.5.4-11.fc32 URL: https://javaee.github.io/metro-xmlstreambuffer/ Please consult the package updates policy before you issue an update to a stable branch: https://fedoraproject.org/wiki/Updates_Policy More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/89340/ -- You are receiving this mail because: You are on the CC list for the bug.

1 12

[Bug 1870860] New: auto-1.7.4 is available
by bugzilla＠redhat.com 15 Dec '21

15 Dec '21

https://bugzilla.redhat.com/show_bug.cgi?id=1870860 Bug ID: 1870860 Summary: auto-1.7.4 is available Product: Fedora Version: rawhide Status: NEW Component: auto Keywords: FutureFeature, Triaged Assignee: mat.booth(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, lef(a)fedoraproject.org, mat.booth(a)redhat.com, puntogil(a)libero.it Target Milestone: --- Classification: Fedora Latest upstream release: 1.7.4 Current version/release in rawhide: 1.5.4-4.fc33 URL: https://github.com/google/auto Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://fedoraproject.org/wiki/Upstream_release_monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from anitya: https://release-monitoring.org/project/6371/ -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1851019] New: CVE-2020-2875mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
by bugzilla＠redhat.com 14 Dec '21

14 Dec '21

https://bugzilla.redhat.com/show_bug.cgi?id=1851019 Bug ID: 1851019 Summary: CVE-2020-2875mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: mkaplan(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bgeorges(a)redhat.com, bibryam(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, clement.escoffier(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, databases-maint(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gmorling(a)redhat.com, gsmet(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcoleman(a)redhat.com, jjanco(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lthon(a)redhat.com, mmuzila(a)redhat.com, mnovotny(a)redhat.com, mschorm(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, odubaj(a)redhat.com, pantinor(a)redhat.com, paradhya(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbiarozk(a)redhat.com, sdaley(a)redhat.com, sdouglas(a)redhat.com, smaestri(a)redhat.com, sponnaga(a)redhat.com, steve.traylen(a)cern.ch, tcunning(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com, xjakub(a)fi.muni.cz Target Milestone: --- Classification: Other Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. References: https://www.oracle.com/security-alerts/cpuapr2020.html https://lists.debian.org/debian-lts-announce/2020/06/msg00015.html https://www.debian.org/security/2020/dsa-4703 -- You are receiving this mail because: You are on the CC list for the bug.

1 14

[Bug 1851014] New: CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete
by bugzilla＠redhat.com 14 Dec '21

14 Dec '21

https://bugzilla.redhat.com/show_bug.cgi?id=1851014 Bug ID: 1851014 Summary: CVE-2020-2934 mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: mkaplan(a)redhat.com CC: aboyko(a)redhat.com, aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, asoldano(a)redhat.com, atangrin(a)redhat.com, avibelli(a)redhat.com, bbaranow(a)redhat.com, bgeorges(a)redhat.com, bibryam(a)redhat.com, bmaxwell(a)redhat.com, bmontgom(a)redhat.com, brian.stansberry(a)redhat.com, cdewolf(a)redhat.com, chazlett(a)redhat.com, clement.escoffier(a)redhat.com, dandread(a)redhat.com, darran.lofthouse(a)redhat.com, databases-maint(a)redhat.com, dkreling(a)redhat.com, dosoudil(a)redhat.com, drieden(a)redhat.com, eparis(a)redhat.com, etirelli(a)redhat.com, ganandan(a)redhat.com, ggaughan(a)redhat.com, gmalinko(a)redhat.com, gmorling(a)redhat.com, gsmet(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, ibek(a)redhat.com, iweiss(a)redhat.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jawilson(a)redhat.com, jbalunas(a)redhat.com, jburrell(a)redhat.com, jcoleman(a)redhat.com, jjanco(a)redhat.com, jochrist(a)redhat.com, jokerman(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, jperkins(a)redhat.com, jschatte(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, kconner(a)redhat.com, krathod(a)redhat.com, kverlaen(a)redhat.com, kwills(a)redhat.com, ldimaggi(a)redhat.com, lgao(a)redhat.com, lthon(a)redhat.com, mmuzila(a)redhat.com, mnovotny(a)redhat.com, mschorm(a)redhat.com, msochure(a)redhat.com, msvehla(a)redhat.com, mszynkie(a)redhat.com, nstielau(a)redhat.com, nwallace(a)redhat.com, odubaj(a)redhat.com, pantinor(a)redhat.com, paradhya(a)redhat.com, pgallagh(a)redhat.com, pjindal(a)redhat.com, pmackay(a)redhat.com, psotirop(a)redhat.com, puntogil(a)libero.it, rguimara(a)redhat.com, rrajasek(a)redhat.com, rruss(a)redhat.com, rstancel(a)redhat.com, rsvoboda(a)redhat.com, rsynek(a)redhat.com, rwagner(a)redhat.com, sbiarozk(a)redhat.com, sdaley(a)redhat.com, sdouglas(a)redhat.com, smaestri(a)redhat.com, sponnaga(a)redhat.com, steve.traylen(a)cern.ch, tcunning(a)redhat.com, tkirby(a)redhat.com, tom.jenkinson(a)redhat.com, vhalbert(a)redhat.com, xjakub(a)fi.muni.cz Target Milestone: --- Classification: Other Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.14 and prior and 5.1.48 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data -- You are receiving this mail because: You are on the CC list for the bug.

1 16

[Bug 1785711] New: CVE-2019-17563 tomcat: session fixation
by bugzilla＠redhat.com 30 Nov '21

30 Nov '21

https://bugzilla.redhat.com/show_bug.cgi?id=1785711 Bug ID: 1785711 Summary: CVE-2019-17563 tomcat: session fixation Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: gsuckevi(a)redhat.com CC: aileenc(a)redhat.com, akoufoud(a)redhat.com, alazarot(a)redhat.com, alee(a)redhat.com, almorale(a)redhat.com, anstephe(a)redhat.com, chazlett(a)redhat.com, coolsvap(a)gmail.com, csutherl(a)redhat.com, drieden(a)redhat.com, etirelli(a)redhat.com, extras-orphan(a)fedoraproject.org, ggaughan(a)redhat.com, gzaronik(a)redhat.com, ibek(a)redhat.com, ivan.afonichev(a)gmail.com, janstey(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jclere(a)redhat.com, jochrist(a)redhat.com, jstastny(a)redhat.com, jwon(a)redhat.com, krathod(a)redhat.com, krzysztof.daniel(a)gmail.com, kverlaen(a)redhat.com, lgao(a)redhat.com, mbabacek(a)redhat.com, mnovotny(a)redhat.com, myarboro(a)redhat.com, paradhya(a)redhat.com, pjindal(a)redhat.com, rhcs-maint(a)redhat.com, rrajasek(a)redhat.com, rsynek(a)redhat.com, sdaley(a)redhat.com, weli(a)redhat.com Target Milestone: --- Classification: Other When using FORM authentication there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability. Reference: https://tomcat.apache.org/security-7.html https://tomcat.apache.org/security-8.html http://tomcat.apache.org/security-9.html Upstream commits: https://github.com/apache/tomcat/commit/ab72a10 https://github.com/apache/tomcat/commit/e19a202 https://github.com/apache/tomcat/commit/1ecba14 -- You are receiving this mail because: You are on the CC list for the bug.

1 41

[Bug 1858077] New: relaxngcc fails to build with java-11-openjdk
by bugzilla＠redhat.com 30 Nov '21

30 Nov '21

https://bugzilla.redhat.com/show_bug.cgi?id=1858077 Bug ID: 1858077 Summary: relaxngcc fails to build with java-11-openjdk Product: Fedora Version: rawhide Hardware: All OS: All Status: NEW Component: relaxngcc Severity: high Assignee: sanjay.ankur(a)gmail.com Reporter: jvanek(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: decathorpe(a)gmail.com, java-maint-sig(a)lists.fedoraproject.org, java-sig-commits(a)lists.fedoraproject.org, jvanek(a)redhat.com, puntogil(a)libero.it, sanjay.ankur(a)gmail.com, sgehwolf(a)redhat.com Blocks: 1825969 (Java11) Target Milestone: --- Classification: Fedora relaxngcc fails to build with java-11-openjdk as sytem JDK. See https://fedoraproject.org/wiki/Changes/Java11 . See especially part about known failures: https://fedoraproject.org/wiki/Changes/Java11#common_issues_packagers_can_f… For the build logs, see: https://koji.fedoraproject.org/koji/taskinfo?taskID=47161757 We run the rebuild longer then 10days ago. Log may be gone. Also your package may be passing in regular rawhide. To reproduce, simply: fedpkg clone relaxngcc; cd relaxngcc; fedpkg build --target f33-java11; #The target is crucial. We run two reruns your package failed both. We had tried 650 packages, and 500 had passed, so the java-11-openjdk will be system JDK in f33, and you should fix your package if you want to keep it alive. Usually the fix is simple, and best is to update the package to latest upstream version. There will be usual mass rebuild once f33 branches. You may got another FTBFS bug. Let us know here if you have any questions, here in bug, or at java-devel(a)lists.fedoraproject.org . We'd appreciate help from the people who know this package best, but if you don't want to work on this now, let us know so we can try to work around it on our side if needed. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1825969 [Bug 1825969] java-11-openjdk as system JDK in F33 -- You are receiving this mail because: You are on the CC list for the bug.

1 6

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits August 2020