Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

On 11/07/2015 04:25 AM, Bernd Eckenfels wrote: > Hello, > > I tried to raise that concern in the message already, but it is probably > worth repeating it explicitly: this is not a real bug > in the Commons-Collection class, and it might not be worse fixing it, as > there are possibly tons of other

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

On 11/07/2015 11:19 AM, Mark Thomas wrote: > On 07/11/2015 10:13, Thomas Neidhart wrote: >> On 11/07/2015 04:25 AM, Bernd Eckenfels wrote: >>> Hello, >>> >>> I tried to raise that concern in the message already, but it is probably >>> worth repeating

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

On 11/08/2015 01:32 PM, Mark Thomas wrote: > On 08/11/2015 10:18, Thomas Neidhart wrote: >> On 11/07/2015 11:19 AM, Mark Thomas wrote: >>> On 07/11/2015 10:13, Thomas Neidhart wrote: >>>> On 11/07/2015 04:25 AM, Bernd Eckenfels wrote: >>>>> Hello, >

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

On 11/08/2015 07:51 PM, James Carman wrote: > Couldn't they use the same attack vector to set a system property also? I > do believe that would be possible for this you need a way to execute code via a de-serialized class. Right now, the simplest way to do so is via the InvokerTransformer. There

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

On 11/08/2015 08:20 PM, James Carman wrote: > I think this entire thing can be prevented with a security manager and a > proper policy in place. Nobody does that, though You cannot prevent the use of reflection for public methods via a SecurityManager. If you then look at the different provided p

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

On 11/08/2015 09:11 PM, James Carman wrote: > How did we get to the point where someone could invoke arbitrary bytecode? Take a look at class TemplatesImpl in com.sun.org.apache.xalan.internal.xsltc.trax which is part of the oracle and openjdk jre. It is serializable and can load so called Transl

Re: [collection][security] InvokerTransformer missused in java object serialisation exploits

On 11/08/2015 09:36 PM, James Carman wrote: > Oh nasty! I must've met, this is quite a fascinating exploit. I'm going to > do some digging later today when I am at my computer. I just figured that the xalan code already does have a system property to prevent translets from being de-serialized:

[collections] Review of proposed fix for InvokerTransformer exploit

Hi all, please review the proposed fix for this issue here: http://svn.apache.org/viewvc?view=revision&revision=1713307 Thanks, Thomas - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mai

Re: [collections] Review of proposed fix for InvokerTransformer exploit

On Mon, Nov 9, 2015 at 10:37 AM, Emmanuel Bourg wrote: > Le 08/11/2015 23:21, Thomas Neidhart a écrit : > > > please review the proposed fix for this issue here: > > The exception message ends with a comma, is this a typo? I suggest > mentioning the system property in t

Re: invoker-defender Java agent

On 11/09/2015 12:34 PM, Eirik Bjørsnøs wrote: > Hi, > > Following the "recent" "news" about Java deserialization security issues, I > decided to create: > > https://github.com/kantega/invoker-defender/ > > This is a Java Agent which removes java.io.Serializable from classes known > to be vulnera

[VOTE] Release Commons Collections 3.2.2 Based on RC1

Hi all, in order to provide a work-around for the known remote code exploit via java de-serialization of malicious InvokerTransformer instances, I would like to start a vote to release Commons Collections 3.2.2 based on RC1. I would kindly ask people to review the RC especially wrt the following

Re: [VOTE] Release Commons Collections 3.2.2 Based on RC1

On 11/10/2015 09:59 PM, Luc Maisonobe wrote: > Le 09/11/2015 23:37, Thomas Neidhart a écrit : >> Hi all, >> >> in order to provide a work-around for the known remote code exploit via >> java de-serialization of malicious InvokerTransformer instances, I would >>

Re: [VOTE] Release Commons Collections 3.2.2 Based on RC1

files. Thomas > > There is also the issue of the possibly wrong revision being tagged or > being used in the VOTE email thread. That can be fixed for RC2 as well. > > Gary > > On Mon, Nov 9, 2015 at 2:37 PM, Thomas Neidhart > wrote: > >> Hi all, >> >&g

Re: [VOTE] Release Commons Collections 3.2.2 Based on RC1

On 11/10/2015 11:41 PM, Gary Gregory wrote: > On Tue, Nov 10, 2015 at 2:22 PM, Thomas Neidhart > wrote: > >> On 11/10/2015 10:52 PM, Gary Gregory wrote: >>> Hi all: >>> >>> -1 >>> >>> Sorry, the RAT failure needs to be handled

[CANCEL][VOTE] Release Commons Collections 3.2.2 Based on RC1

On 11/09/2015 11:37 PM, Thomas Neidhart wrote: > Hi all, > > in order to provide a work-around for the known remote code exploit via > java de-serialization of malicious InvokerTransformer instances, I would > like to start a vote to release Commons Collections 3.2.2 based on RC

[VOTE] Release Commons Collections 3.2.2 Based on RC2

Hi all, in order to provide a work-around for the known remote code exploit via java de-serialization of malicious InvokerTransformer instances, I would like to start a vote to release Commons Collections 3.2.2 based on RC2. Notes: * the site will not be published, it just serves as a reference

[CANCEL][VOTE] Release Commons Collections 3.2.2 Based on RC2

On 11/11/2015 05:27 PM, Thomas Neidhart wrote: > Hi all, > > in order to provide a work-around for the known remote code exploit via > java de-serialization of malicious InvokerTransformer instances, I would > like to start a vote to release Commons Collections 3.2.2 based on

Re: [VOTE] Release Commons Collections 3.2.2 Based on RC2

On 11/12/2015 07:14 PM, Jörg Schaible wrote: > Hi Thomas, > > Thomas Neidhart wrote: > >> Hi all, >> >> in order to provide a work-around for the known remote code exploit via >> java de-serialization of malicious InvokerTransformer instances, I would >&g

[VOTE] Release Commons Collections 3.2.2 Based on RC3

Hi all, in order to provide a work-around for the known remote code exploit via java de-serialization of malicious InvokerTransformer instances, I would like to start a vote to release Commons Collections 3.2.2 based on RC3. Notes: * the site will not be published, it just serves as a reference

Re: [VOTE] Release Commons Collections 3.2.2 Based on RC3

", version: "6.1", arch: "amd64", family: "windows" > > and: > > Apache Ant(TM) version 1.9.6 compiled on June 29 2015 > > Gary > > On Thu, Nov 12, 2015 at 3:31 PM, Thomas Neidhart > wrote: > >> Hi all, >> >> in

[RESULT][VOTE] Release Commons Collections 3.2.2 Based on RC3

On 11/13/2015 12:31 AM, Thomas Neidhart wrote: > Hi all, [snip] > Considering that this is a security related release and that RC2 did not > show any functional problems with the release, I plan to close this vote > in 24h from now, i.e. after 0100 GMT 14-November 2015 Here is a

Re: [RESULT][VOTE] Release Commons Collections 3.2.2 Based on RC3

On 11/14/2015 04:20 PM, Uwe Barthel wrote: > Thx Thomas. > > The fix for the Java serialization vulnerability is on the way. > Now should we add some information on > http://commons.apache.org/security.html like Commons Compress did? yes, we will do something similar. Thomas ---

[ANNOUNCMENT] Apache Commons Collections 3.2.2 Released

The Apache Commons team is pleased to announce the release of Apache Commons Collections 3.2.2. The release is available for download at http://commons.apache.org/proper/commons-collections/download_collections.cgi Apache Commons Collections is a project to develop and maintain collection classe

Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released

On 11/15/2015 11:23 PM, Thomas Neidhart wrote: should have been an ANNOUNCEMENT, but it's late, sorry. Thomas - To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail:

Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released

Hi, I did not test the ant build, but I explicitly removed the MANIFEST.MF as this has to be created by the relevant plugins as setup in the commons-parent.pom (especially for proper OSGI metadata). I will take a look this evening how to mitigate this. Thomas On Mon, Nov 16, 2015 at 11:19 AM, E

Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released

plugins configured). Thomas On Mon, Nov 16, 2015 at 11:46 AM, Thomas Neidhart wrote: > Hi, > > I did not test the ant build, but I explicitly removed the MANIFEST.MF as > this has to be created by the relevant plugins as setup in the > commons-parent.pom (especially for proper OSGI m

Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released

The problem is that the resulting manifest will be different for the ant and maven builds (as for most other components). Thomas On Mon, Nov 16, 2015 at 12:18 PM, Emmanuel Bourg wrote: > Le 16/11/2015 12:07, Thomas Neidhart a écrit : > > Would it be much effort to switch to a maven-st

[collections] Review of MultiValuedMap interface & implementations

Hi, we had to remove the use of reflection in the MultiValuedMap implementations (due to COLLECTIONS-580), which required a huge effort to refactor the various implementations. Now, there are only strongly typed implementations: * ArrayListValuedHashMap * HashSetValuedHashMap that do not re

Re: [COLLECTIONS] Release road map for 4.1

On 11/21/2015 11:45 AM, Uwe Barthel wrote: > Hi, > > How is the road map for the 4.1 release or is there a plan to provide 4.0.1? the plan is to start the release process tomorrow. There is only one issue open that needs to be resolved for a 4.1 release, and I am working on it. Thomas

[VOTE] Release Commons Collections 4.1 Based on RC1

Hi all, we have accumulated enough changes since the last 4.0 release as well as we need to provide a fix for the known remote code exploit via java de-serialization. Therefore, I would like to start a vote to release Commons Collections 4.1 based on RC1. Note: The fix for the security related i

Re: [VOTE] Release Validator 1.5.0 based on RC1

On 11/19/2015 10:48 AM, sebb wrote: > It's probably about time to release VALIDATOR. > There have been quite a few improvements and fixes since the last version. > > == > > Validator 1.5.0 RC1 is available for review here: > https://dist.apache.org/repos/dist/dev/commons/validator/ (svn > rev

Re: [VOTE] Release NET 3.4 based on RC2 - resend with corrected tag

On 11/22/2015 04:58 PM, sebb wrote: > It's probably about time to release NET. > There have been quite a few improvements and fixes since the last version. > > [This is a repeat of the original mail, but using a tag that actually > exists this time] > > == > > Net 3.4 RC2 is available for review

Re: [VOTE] Release Commons Collections 4.1 Based on RC1

On 11/23/2015 09:53 PM, Oliver Heger wrote: > The Maven build worked fine with Java 1.6 and 1.7 on Windows 10. With > Java 1.8 I get the following compilation error in test classes: > > [ERROR] COMPILATION ERROR : > [INFO] - > [ERROR] > /

Re: svn commit: r1716090 - in /commons/proper/collections/trunk: .travis.yml README.md pom.xml

Actually, it does not work yet, as I can not enable commons-collections on travis. I already sent an email to them, but did not get an answer yet. How did you manage to do it for commons-lang? Thomas On Tue, Nov 24, 2015 at 5:36 PM, Benedikt Ritter wrote: > Nice! > > 2015-11-24 10:25 GMT+01:00

Re: [JXPATH] Java Version

On 11/24/2015 09:55 PM, Uwe Barthel wrote: >> I've updated JXPATH to Java 7. There is a lot of work to update the code >> base to use Java 7 languages features and APIs. I invite everybody to join >> me here… > > Do you like to start these changes before or after the release 1.4? > I prefer to cre

Re: [VOTE] Release Commons Collections 4.1 Based on RC1

On 11/22/2015 11:26 PM, Thomas Neidhart wrote: > Hi all, > > we have accumulated enough changes since the last 4.0 release as well as > we need to provide a fix for the known remote code exploit via java > de-serialization. Therefore, I would like to start a vote to release > C

Re: [VOTE] Release Commons Collections 4.1 Based on RC1

On 11/24/2015 11:30 PM, Jörg Schaible wrote: > Hi Thomas, > > Thomas Neidhart wrote: > >> Hi all, >> >> we have accumulated enough changes since the last 4.0 release as well as >> we need to provide a fix for the known remote code exploit via java >> de

Re: [VOTE] Release Commons Collections 4.1 Based on RC1

On 11/25/2015 11:30 AM, Jörg Schaible wrote: > Hi Thomas, > > Thomas Neidhart wrote: > >> On 11/24/2015 11:30 PM, Jörg Schaible wrote: >>> Hi Thomas, >>> >>> Thomas Neidhart wrote: > > [snip] > >> These test failures exist since the 4

[CANCEL][VOTE] Release Commons Collections 4.1 Based on RC1

On 11/22/2015 11:26 PM, Thomas Neidhart wrote: > Hi all, > > we have accumulated enough changes since the last 4.0 release as well as > we need to provide a fix for the known remote code exploit via java > de-serialization. Therefore, I would like to start a vote to release > C

[VOTE] Release Commons Collections 4.1 Based on RC2 (24h vote)

Hi all, we have accumulated enough changes since the last 4.0 release as well as we need to provide a fix for the known remote code exploit via java de-serialization. Therefore, I would like to start a vote to release Commons Collections 4.1 based on RC2. Note: * The fix for the security relate

Re: [CANCEL][VOTE] Release Commons Collections 4.1 Based on RC1

On 11/25/2015 09:04 PM, Gary Gregory wrote: > On Wed, Nov 25, 2015 at 11:40 AM, Thomas Neidhart > wrote: > >> On 11/22/2015 11:26 PM, Thomas Neidhart wrote: >>> Hi all, >>> >>> we have accumulated enough changes since the last 4.0 release as well as

[VOTE][RESULT] Release Commons Collections 4.1 Based on RC2 (24h vote)

Voting was as follows: +1 (binding) Luc Maisonobe Joerg Schaible Oliver Heger Phil Steitz Gary Gregory Thomas Neidhart There were no other votes. The vote therefore passes. Thanks to all who voted. Thomas - To unsubscribe

[ANNOUNCEMENT] Apache Commons Collections 4.1 Released

The Apache Commons team is pleased to announce the release of Apache Commons Collections 4.1. The release is available for download at http://commons.apache.org/proper/commons-collections/download_collections.cgi Apache Commons Collections is a project to develop and maintain collection classes

[collections] Next Steps after 4.1 release

Hi all, we have just released a new version of the collections component and I wanted to start a discussion about the future of this component. In the past years I spent some time to clean up the component and also add a few things that I found worth the effort (which I tend to use in my day jobs

[math] Adding badges

Hi, recently I added some badges (building on travis, code coverage with coveralls, license tag, latest available version from maven) to collections, which can be seen here: https://github.com/apache/commons-collections Any objection to add the same for math? The travis integration can be quite

Re: [math] Adding badges

On 12/02/2015 08:29 PM, Luc Maisonobe wrote: > Le 02/12/2015 09:57, Thomas Neidhart a écrit : >> Hi, >> >> recently I added some badges (building on travis, code coverage with >> coveralls, license tag, latest available version from maven) to >> collections,

Re: [VOTE] Release Configuration 2.0-beta2 based on RC1

On 12/01/2015 10:25 PM, Oliver Heger wrote: > Hi all, > > to continue the current series of releases, this is a vote for the > second beta version of [configuration] 2.0 based on the first release > candidate. After beta1 was released in June there has been some feedback > which lead to some minor

Re: [math] MATH 4 requires at least java 7, build also the MATH_3_X branch.

tp://git-wip-us.apache.org/repos/asf/commons-math/diff/25de9b78 > > > > Branch: refs/heads/master > > Commit: 25de9b7800887c12365f6a19b13cf32baf5bfe2f > > Parents: 7afc1c3 > > Author:

Re: [collections][site] publish security-report? (was: svn commit: r1719350 - /commons/proper/collections/trunk/src/site/xdoc/security-reports.xml)

On 12/11/2015 01:16 PM, Bernd Eckenfels wrote: > Hello, > > I added a second CVE to the de-serialisation security-report for > ACC, I dont have the infrastrcuture handy to push the site, can > somebody do that, please? fixed the respective html directly on the site repository. Thomas --

Re: [math] Refactored Precision

On Mon, Dec 14, 2015 at 9:17 AM, Ole Ersoy wrote: > Hi, > > Just a heads up for those of you interested or have nothing better to do > at 2 am :). I refactored the Precision class into classes PrecisionAssert > and RoundDouble. > > https://github.com/firefly-numbers/firefly-numbers > > I created

Re: [Math] Exceptions from "JDKRandomGenerator"

On 12/21/2015 04:41 AM, Gilles wrote: > On Sat, 19 Dec 2015 11:35:26 -0700, Phil Steitz wrote: >> On 12/19/15 9:02 AM, Gilles wrote: >>> Hi. >>> >>> While experimenting on >>> https://issues.apache.org/jira/browse/MATH-1300 >>> I created a new >>> JDKRandomGeneratorTest >>> that inherits from >

Re: [Math] Exceptions from "JDKRandomGenerator"

On 12/23/2015 05:39 PM, Gilles wrote: > On Wed, 23 Dec 2015 16:26:52 +0100, Thomas Neidhart wrote: >> On 12/21/2015 04:41 AM, Gilles wrote: >>> On Sat, 19 Dec 2015 11:35:26 -0700, Phil Steitz wrote: >>>> On 12/19/15 9:02 AM, Gilles wrote: >>>>> Hi. >

Re: [Math] About the refactoring of RNGs (Was: [01/18] [math] MATH-1307)

On 12/29/2015 04:33 AM, Phil Steitz wrote: > On 12/28/15 8:08 PM, Gilles wrote: >> On Mon, 28 Dec 2015 11:08:56 -0700, Phil Steitz wrote: >>> The significant refactoring to eliminate the (standard) next(int) >>> included in these changes has the possibility of introducing subtle >>> bugs or perform

Re: [Math] About the refactoring of RNGs

On 12/29/2015 05:10 PM, Gilles wrote: > On Tue, 29 Dec 2015 10:33:15 +0100, Luc Maisonobe wrote: >> Hi all, >> >> Le 29/12/2015 09:21, Thomas Neidhart a écrit : >>> On 12/29/2015 04:33 AM, Phil Steitz wrote: >>>> On 12/28/15 8:08 PM, Gilles wrote: >

Re: [math] releasing 3.6

On 12/29/2015 07:39 PM, Luc Maisonobe wrote: > Hi all, > > A few weeks ago, I proposed to release 3.6. There were two > points I wanted to address before that, both related to > ODE. These points are now completed: the Adams methods > stability issues have been fixed, and a bunch a field-based > i

Re: [VOTE][RC2] Release Commons Math 3.6

On 01/02/2016 09:15 PM, Luc Maisonobe wrote: > This is a [VOTE] for releasing Apache Commons Math 3.6 from release > candidate 2. > > Tag name: > MATH_3_6_RC2 (signature can be checked from git using 'git tag -v') > > Tag URL: > >

Re: [Math] Add 64-bits based RNG (Was: [Math] New base class for all RNGs)

On 01/10/2016 05:09 AM, Gilles wrote: > Hi. > > Relevant excerpt of previous posts: > >>> [...] >>> >>> Something implicit in "BitStreamGenerator": the maximum number of >>> bits is 32 (cf. return type of "next(int)" and the ubiquitous use >>> of hard-coded "32". >>> >>> What about the possibilit

Re: [Math] Add 64-bits based RNG (Was: [Math] New base class for all RNGs)

On Mon, Jan 11, 2016 at 1:10 PM, Gilles wrote: > On Mon, 11 Jan 2016 07:47:40 +0100, Thomas Neidhart wrote: > >> On 01/10/2016 05:09 AM, Gilles wrote: >> >>> Hi. >>> >>> Relevant excerpt of previous posts: >>> >>> [...] >>>

Re: [math] TLP

On Thu, Jan 14, 2016 at 1:50 AM, Phil Steitz wrote: > I would like to propose that we split [math] out into a top level > project at the ASF. This has been proposed before, and I have > always come down on the side of staying in Commons, but I am now > convinced that it is a good step for us to

Re: [VOTE] Form a separate TLP based on [math]

On 01/16/2016 04:18 PM, Phil Steitz wrote: > The discussion has thus far been generally favorable. I would like > therefore to put the proposal to split [math] out into a separate > TLP to a VOTE. Assuming a favorable vote, we can discuss how to go > about doing it. Votes, please. All are welco

Re: [Math] Revamping the "random" package or ...

On 01/17/2016 02:34 PM, Gilles wrote: > On Sun, 17 Jan 2016 10:56:38 +0100, Luc Maisonobe wrote: >> Le 16/01/2016 16:51, Gilles a écrit : >>> Hi. >>> >>> Context: nobody gave an opinion on the arguments which I put >>> forward in these posts: >>> http://markmail.org/message/uiljlf63uucnfyy2 >>>

Re: [math] Volunteer for the new TLP PMC

On Sun, Jan 24, 2016 at 9:54 PM, Phil Steitz wrote: > Please respond to this thread if you are a Commons Committer > interested in joining the PMC for the new TLP based on [math]. > Hi Phil, thanks for pushing this whole issue! I am happy to volunteer for the new PMC to be formed. Thomas

Re: [math] Name of the new TLP

On 01/25/2016 09:27 PM, Gary Gregory wrote: > On Jan 25, 2016 10:11 AM, "Emmanuel Bourg" wrote: >> >> Le 25/01/2016 18:52, Gilles a écrit : >> >>> AFAICT, the real issue is one of policy: Commons is supposed to be > stable, >>> stable, stable and stable (IIUC). >>> >>> And CM is far from being mat

Fwd: Re: svn commit: r12178 - in /release/commons/collections: binaries/ source/

Forwarded Message Subject: Re: svn commit: r12178 - in /release/commons/collections: binaries/ source/ Date: Tue, 2 Feb 2016 19:07:08 +0100 From: Thomas Neidhart To: comm...@commons.apache.org On 02/02/2016 07:03 PM, s...@apache.org wrote: > Author: sebb > Date: Tue

Re: [math] [POLL] new TLP name

On 02/01/2016 06:06 PM, Phil Steitz wrote: > Please select your top choice among the following suggested names > for the new [math]-based TLP. All are welcome and encouraged to > respond. This POLL will be open for 72 hours, at which time two > tallies will be presented: one among those who have

Re: [math] [POLL] new TLP name

On Thu, Feb 4, 2016 at 2:24 PM, Phil Steitz wrote: > On 2/2/16 11:44 AM, Thomas Neidhart wrote: > > On 02/01/2016 06:06 PM, Phil Steitz wrote: > >> Please select your top choice among the following suggested names > >> for the new [math]-based TLP. All are welcome and

Re: [all] apologies

On Mon, Feb 8, 2016 at 9:13 PM, Phil Steitz wrote: > I am sorry for the bad tone of my recent posts here. Not the nicest > way to leave and I am sorry for that. > Hi Phil, nothing that you have written is worth an apology, although I can understand your disappointment about the way (or motive)

Re: [math] questions on GA

On 03/18/2016 02:12 PM, Семенов Кирилл wrote: >> >> In effect, some time ago we evoked the possibility to drop GA support >> altogether since the code seemed little used and a lot of work was >> anticipated for making it useful beyond demo applications. > > > It is rather surprising, that ASF doe

Re: [math] Staging site

On 03/21/2016 07:32 PM, Evan Ward wrote: > Hi, > > I'm on step 19 in Release.howto.txt, I've committed the updated site > using svn, but I get a 404 when I try to view it at > http://commons.staging.apache.org/proper/commons-math > > Any ideas what I'm doing wrong? I've noticed that the staging U

Re: [collections] An order statistic tree

On Fri, Mar 18, 2016 at 2:23 PM, Rodion Efremov < rodio...@cs.helsinki.fi.invalid> wrote: > Hello, all. > I would like to announce that I have a java.util.Set implementation that > is an order statistic tree (all non-bulk operations + select + rank in > O(log n) time) [1]. However, it seems like t

<    4   5   6   7   8   9