Your message dated Mon, 24 Nov 2014 22:49:05 +0000 with message-id <e1xt2rn-0007m0...@franck.debian.org> and subject line Bug#770544: fixed in resteasy 3.0.6-2 has caused the Debian Bug report #770544, regarding resteasy: CVE-2014-7839: External entities expanded by DocumentProvider to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 770544: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770544 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Source: resteasy Version: 3.0.6-1 Severity: grave Tags: security upstream Hi, the following vulnerability was published for resteasy. I have choosen severity grave due to what is described in Red Hat's bugzilla about the issue, but I don't know jboss/resteasy/... well enough, so feel free to downgrade to important if you don't agree. CVE-2014-7839[0]: External entities expanded by DocumentProvider If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2014-7839 [1] https://issues.jboss.org/browse/RESTEASY-1130 [2] https://bugzilla.redhat.com/show_bug.cgi?id=1165328 Regards, Salvatore
--- End Message ---
--- Begin Message ---Source: resteasy Source-Version: 3.0.6-2 We believe that the bug you reported is fixed in the latest version of resteasy, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 770...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Emmanuel Bourg <ebo...@apache.org> (supplier of updated resteasy package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.8 Date: Mon, 24 Nov 2014 23:36:45 +0100 Source: resteasy Binary: libresteasy-java Architecture: source all Version: 3.0.6-2 Distribution: unstable Urgency: high Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Emmanuel Bourg <ebo...@apache.org> Description: libresteasy-java - RESTEasy -- Framework for RESTful Web services and Java applicati Closes: 770544 Changes: resteasy (3.0.6-2) unstable; urgency=high . * Team upload. * Fix CVE-2014-7839: External entities expanded by DocumentProvider (Closes: #770544) * Standards-Version updated to 3.9.6 (no changes) Checksums-Sha1: d3b5afc588d3c4e8e30f512f6c73148dd7133db0 2286 resteasy_3.0.6-2.dsc 0a7fb3a75731cd23e385000c8eaa5148f837c461 11920 resteasy_3.0.6-2.debian.tar.xz 4c47857deae94423529f715d81b9b3faa6a9ce3f 1191620 libresteasy-java_3.0.6-2_all.deb Checksums-Sha256: 03eae3432d98e0ee9dc71977fe119d762fbce84a36ecee83f8e7469ca3fc10fa 2286 resteasy_3.0.6-2.dsc f8e784998d491d8fc4e1f8a9014a9662d34be95ea0aa029f001c93cc07de8d3b 11920 resteasy_3.0.6-2.debian.tar.xz 4be92b2484634439ab4eade1c319ff6a01667b572e9569840c9a757b64176e3d 1191620 libresteasy-java_3.0.6-2_all.deb Files: 949336df326f08b5bde5faa8919cf8df 2286 java optional resteasy_3.0.6-2.dsc c6de2ea537163890e827053b76c10747 11920 java optional resteasy_3.0.6-2.debian.tar.xz eae9b861c9b848c8b4682d2cfce2db4c 1191620 java optional libresteasy-java_3.0.6-2_all.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJUc7RfAAoJEPUTxBnkudCspPQP/ilgqjb3bDqWEfErMLjYduAO w+navVAlRPUR42s4lGu1nvzgsD9wXKoUMDIZ8D2XLctl+N9RQyygb9eHk694mlNz Qrbm0zYVG54vOzp1gLhDJUMd9rmhJDaPr+2GLzw5QwN3Qj3brI7UU8L0eJbmU8I4 msdLYGERLVzD831zZ2151fvX1Dakvf2/noL1UN/+JMM07QAF7c41SFK78Q39hEQU Y3QBW+4sz0O2qAgD8RlK54YRcQyuSAMcLKSTx3BaTUKFEwmpO/jGU0vFpzsw7XFj vp6ux5UsaNbZ8In1XDcjCoBTBCi64hHPurBiK2mgliT98lsNdMJnUBlTeYmBH0jL eIbLE9/3qF725kVWi2qqMkMHACvEBknT2zi6wCipbgdVpDSCXwbXpR5whqr4d0zE bzXRfA5aTsUpsgiEtjYUUU39BfThFDJJcLAMLeRVzEgE0sjJFoZTxga52cf2Hrri /VTZWYNM+mFHJnX1a1HCv/DPfL+u8QFGmVhc7IcdEBb+IpCMtDScPW+d5cckmz5r nraktLT3w4iIWhNXCgjYI3dOkB1yKKBNgvJ+uoT0Eh+Ijagb+XyXVmAfacvdHcmn c3H1iCdHaQQi1yKtZIHLIT5jDVeogc3gfr0NkrNv6tyw5Peil6vL1pcPwjrMKvga vmTnbxWaH+3IAJAauEqE =Vh0Q -----END PGP SIGNATURE-----
--- End Message ---
__ This is the maintainer address of Debian's Java team <http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use debian-j...@lists.debian.org for discussions and questions.
