A security issue fixed upstream in jackrabbit has been announced: http://openwall.com/lists/oss-security/2015/05/21/6 http://openwall.com/lists/oss-security/2015/05/21/7 There are patches available in the second message linked above, and the fixes will be incorporated into a 2.4.6 release. Mageia 4 and Mageia 5 are affected. Reproducible: Steps to Reproduce:
CC: (none) => geiger.david68210, pterjanWhiteboard: (none) => MGA5TOO, MGA4TOO
So, fixes for jackrabbit for Cauldron and mga4 too with the proposed upstream patch done in SVN. Freeze_push for Cauldron requested.
Ok now jackrabbit is uploaded for mga4 and finally it will be soon dropped from Cauldron.
OK, jackrabbit no longer hops in Cauldron. Patched package uploaded for Mageia 4. Thanks David! Advisory: ======================== Updated jackrabbit packages fix security vulnerability: In Apache Jackrabbit before 2.4.6, When processing a WebDAV request body containing XML, the XML parser can be instructed to read content from network resources accessible to the host, identified by URI schemes such as "http(s)" or "file". Depending on the WebDAV request, this can not only be used to trigger internal network requests, but might also be used to insert said content into the request, potentially exposing it to the attacker and others (for instance, by inserting said content in a WebDAV property value using a PROPPATCH request). See also IETF RFC 4918, Section 20.6 (CVE-2015-1833). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1833 http://openwall.com/lists/oss-security/2015/05/21/6 http://openwall.com/lists/oss-security/2015/05/21/7 ======================== Updated packages in core/updates_testing: ======================== jackrabbit-webdav-2.4.2-6.1.mga4 jackrabbit-webdav-javadoc-2.4.2-6.1.mga4 from jackrabbit-2.4.2-6.1.mga4.src.rpm
Version: Cauldron => 4Assignee: dmorganec => qa-bugsWhiteboard: MGA5TOO, MGA4TOO => (none)
MGA4-32 on AcerD620 Xfce No installation issues
CC: (none) => herman.viaeneWhiteboard: (none) => MGA4-32-OK
Tested mga4 64
Whiteboard: MGA4-32-OK => MGA4-32-OK mga4-64-ok
Validating. Advisory uploaded. Please push to 4 updates Thanks
Keywords: (none) => validated_updateWhiteboard: MGA4-32-OK mga4-64-ok => advisory MGA4-32-OK mga4-64-okCC: (none) => sysadmin-bugs
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0242.html
Status: NEW => RESOLVEDResolution: (none) => FIXED
URL: (none) => http://lwn.net/Vulnerabilities/647619/