[ https://issues.apache.org/jira/browse/NUTCH-1590?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14033883#comment-14033883 ]
Hudson commented on NUTCH-1590: ------------------------------- SUCCESS: Integrated in Nutch-trunk #2661 (See [https://builds.apache.org/job/Nutch-trunk/2661/]) NUTCH-1590 [SECURITY] Frame injection vulnerability in published Javadoc (jnioche) (jnioche: http://svn.apache.org/viewvc/nutch/trunk/?view=rev&rev=1603179) * /nutch/trunk/CHANGES.txt * /nutch/trunk/build.xml > [SECURITY] Frame injection vulnerability in published Javadoc > ------------------------------------------------------------- > > Key: NUTCH-1590 > URL: https://issues.apache.org/jira/browse/NUTCH-1590 > Project: Nutch > Issue Type: New Feature > Components: documentation > Affects Versions: 1.7, 2.2 > Reporter: Lewis John McGibbney > Priority: Blocker > Fix For: 1.9 > > Attachments: NUTCH-1590.patch > > > Hi All, > Oracle has announced [1], [2] a frame injection vulnerability in Javadoc > generated by Java 5, Java 6 and Java 7 before update 22. > The infrastructure team has completed a scan of our current project > websites and identified over 6000 instances of vulnerable Javadoc > distributed across most TLPs. The chances are the project(s) you > contribute to is(are) affected. A list of projects and the number of > affected Javadoc instances per project is provided at the end of this > e-mail. > Please take the necessary steps to fix any currently published Javadoc > and to ensure that any future Javadoc published by your project does not > contain the vulnerability. The announcement by Oracle includes a link to > a tool that can be used to fix Javadoc without regeneration. > The infrastructure team is investigating options for preventing the > publication of vulnerable Javadoc. > The issue is public and may be discussed freely on your project's dev list. > [1] > http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html > [2] http://www.kb.cert.org/vuls/id/225657 > nutch.apache.org 8 -- This message was sent by Atlassian JIRA (v6.2#6252)