GNU bug report logs

#47342 java-xstream@1.4.15 is vulnerable to CVE-2021-21341, CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21345, CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349, CVE-2021-21350 and CVE-2021-21351

PackageSource(s)Maintainer(s)
guix PTS Buildd Popcon
Full log

Message #27 received at 47342-done@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47342-done) by debbugs.gnu.org; 23 Mar 2021 22:31:47 +0000
From debbugs-submit-bounces@debbugs.gnu.org Tue Mar 23 18:31:47 2021
Received: from localhost ([127.0.0.1]:33313 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1lOpYx-0005ul-1v
	for submit@debbugs.gnu.org; Tue, 23 Mar 2021 18:31:47 -0400
Received: from lepiller.eu ([89.234.186.109]:41888)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <julien@lepiller.eu>) id 1lOpYu-0005ua-7I
 for 47342-done@debbugs.gnu.org; Tue, 23 Mar 2021 18:31:46 -0400
Received: from lepiller.eu (localhost [127.0.0.1])
 by lepiller.eu (OpenSMTPD) with ESMTP id e093072d;
 Tue, 23 Mar 2021 22:31:42 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=lepiller.eu; h=date:from
 :to:cc:subject:message-id:in-reply-to:references:mime-version
 :content-type:content-transfer-encoding; s=dkim; bh=ByIejt2Cu3/A
 nG5VXoDJn/23GKFW8XgG6eQ21OQmIuI=; b=fGlD+iNPlHy8ldiAnas3x4UXqWQi
 nUn0QK/MHWVJVf7r90D+0khMPAi2F966ERVOq24LIM7lzuB8fsx1f28BTBIyv8vZ
 JchyJ23+3hncXgteJkUFDjCGrrNmvZOOEZNOic9xpInOKyzNHDo/jmXHDOJGiXYR
 0z2ggFhxa3DnSGayfl8GuAxH/vR2uRA1Hv+75SAmF866ODRHSCcFt8SqDODqOn4x
 aI06Y96pDTa9fLB6sykfwCODydqzgR92vp5Q1scjBg/IMxc7Pfe9tcFfZnhFAmQI
 qa+71LFZbG4TSMqBL0iy0DjD81fYAwRp3LXg1dOAs+Xq+xGks0SUQp8vaA==
Received: by lepiller.eu (OpenSMTPD) with ESMTPSA id b41949f6
 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); 
 Tue, 23 Mar 2021 22:31:41 +0000 (UTC)
Date: Tue, 23 Mar 2021 23:31:32 +0100
From: Julien Lepiller <julien@lepiller.eu>
To: 47342-done@debbugs.gnu.org
Subject: Re: bug#47342: java-xstream@1.4.15 is vulnerable to CVE-2021-21341,
 CVE-2021-21342, CVE-2021-21343, CVE-2021-21344, CVE-2021-21345,
 CVE-2021-21346, CVE-2021-21347, CVE-2021-21348, CVE-2021-21349,
 CVE-2021-21350 and CVE-2021-21351
Message-ID: <20210323233132.63d67c9b@tachikoma.lepiller.eu>
In-Reply-To: <4b90a1518c9453ca529a5a6c4e12728cd0f2fbc7.camel@zaclys.net>
References: <4b90a1518c9453ca529a5a6c4e12728cd0f2fbc7.camel@zaclys.net>
X-Mailer: Claws Mail 3.17.8 (GTK+ 2.24.32; x86_64-pc-linux-gnu)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: -0.0 (/)
X-Debbugs-Envelope-To: 47342-done
Cc: Léo Le Bouter <lle-bout@zaclys.net>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)
Le Tue, 23 Mar 2021 15:33:26 +0100,
Léo Le Bouter via Bug reports for GNU Guix <bug-guix@gnu.org> a écrit :

> Upstream has made a release: 1.4.16 - which fixes all the issues,
> following is an unfinished patchset that fixes the issues, java-
> mxparser package does not build and help from some more experienced
> Java packagers is welcome to fix and push this patchset.

Pushed as 4490dff98c6979a77f3982716239b526e0ef1337 to
8b2b5463963d5d4dee480b0cf73fa4a9eca414ba to master,
with changes discussed on IRC.

Thanks a lot for noticing it!




Send a report that this bug log contains spam.


debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sat Dec 21 19:00:40 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.