Bug#697888: catalina.policy is enforced *after* symlink traversal

2013-01-10 Thread Sergio Gelato
Package: tomcat6-user Version: 6.0.35-1+squeeze2 (This may affect the tomcat7 packages as well.) While testing tomcat6 with a security manager I found that the default catalina.policy in /usr/share/tomcat6/skel/conf/ resulted in an access control failure trying to read the property org.apache.tom

Bug#691932: did the svn-git migration

2013-01-10 Thread Thomas Koch
http://anonscm.debian.org/gitweb/?p=pkg-java/maven-plugin-tools.git You might want to continue working from there. I tried to do the necessary changes in debian/ myself for the upgrade to 3.2 but I did not succeed. There's too much I do not know about the strange debian/build.xml. Regards, Tho

Bug#697617: jenkins: remote code execution vulnerability

2013-01-10 Thread Miguel Landaeta
On Thu, Jan 10, 2013 at 2:03 PM, James Page wrote: > I did much the same for the version in Ubuntu 12.04 (1.424.6); and hit > similar issues. The key problem is the extent of the patch to fix this > issue and the amount of code change in the TCP/Agent communication > area between 1.480.2 and earli

Bug#697617: jenkins: remote code execution vulnerability

2013-01-10 Thread James Page
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 10/01/13 15:46, Miguel Landaeta wrote: >>> We might want to consider whether updating unstable/testing to >>> 1.480.2 is actually the best way forward at this point in >>> time. > Hi James, > > I don't know if it is feasible at this point in the

Bug#696974: marked as done (jenkins: Security issues were found in Jenkins core)

2013-01-10 Thread Debian Bug Tracking System
Your message dated Thu, 10 Jan 2013 11:32:38 + with message-id and subject line Bug#696974: fixed in jenkins-winstone 0.9.10-jenkins-37+dfsg-2 has caused the Debian Bug report #696974, regarding jenkins: Security issues were found in Jenkins core to be marked as done. This means that you clai

jenkins-winstone_0.9.10-jenkins-37+dfsg-2_amd64.changes ACCEPTED into unstable

2013-01-10 Thread Debian FTP Masters
Accepted: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Thu, 10 Jan 2013 11:03:23 + Source: jenkins-winstone Binary: libjenkins-winstone-java libjenkins-winstone-java-doc Architecture: source all Version: 0.9.10-jenkins-37+dfsg-2 Distribution: unstable Urgency: high Main

Processing of jenkins-winstone_0.9.10-jenkins-37+dfsg-2_amd64.changes

2013-01-10 Thread Debian FTP Masters
jenkins-winstone_0.9.10-jenkins-37+dfsg-2_amd64.changes uploaded successfully to localhost along with the files: jenkins-winstone_0.9.10-jenkins-37+dfsg-2.dsc jenkins-winstone_0.9.10-jenkins-37+dfsg-2.debian.tar.gz libjenkins-winstone-java_0.9.10-jenkins-37+dfsg-2_all.deb libjenkins-winsto

Bug#697617: marked as done (jenkins: CVE-2013-0158: remote code execution vulnerability)

2013-01-10 Thread Debian Bug Tracking System
Your message dated Thu, 10 Jan 2013 10:47:49 + with message-id and subject line Bug#697617: fixed in jenkins 1.480.2+dfsg-1~exp1 has caused the Debian Bug report #697617, regarding jenkins: CVE-2013-0158: remote code execution vulnerability to be marked as done. This means that you claim that

Bug#696816: marked as done (jenkins: Security issues were found in Jenkins core)

2013-01-10 Thread Debian Bug Tracking System
Your message dated Thu, 10 Jan 2013 10:47:49 + with message-id and subject line Bug#696816: fixed in jenkins 1.480.2+dfsg-1~exp1 has caused the Debian Bug report #696816, regarding jenkins: Security issues were found in Jenkins core to be marked as done. This means that you claim that the pro

jenkins_1.480.2+dfsg-1~exp1_amd64.changes ACCEPTED into experimental

2013-01-10 Thread Debian FTP Masters
Accepted: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Thu, 10 Jan 2013 09:50:50 + Source: jenkins Binary: libjenkins-java libjenkins-plugin-parent-java jenkins-common jenkins jenkins-slave jenkins-external-job-monitor jenkins-cli jenkins-tomcat Architecture: source al

Processing of jenkins_1.480.2+dfsg-1~exp1_amd64.changes

2013-01-10 Thread Debian FTP Masters
jenkins_1.480.2+dfsg-1~exp1_amd64.changes uploaded successfully to localhost along with the files: jenkins_1.480.2+dfsg-1~exp1.dsc jenkins_1.480.2+dfsg.orig.tar.gz jenkins_1.480.2+dfsg-1~exp1.debian.tar.gz libjenkins-java_1.480.2+dfsg-1~exp1_all.deb libjenkins-plugin-parent-java_1.480.2+d

Bug#697617: jenkins: remote code execution vulnerability

2013-01-10 Thread James Page
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 09/01/13 00:54, Miguel Landaeta wrote: > Hi, > > I'm working in backporting a fix for this issue to this version of > Jenkins. It doesn't too hard to do it but I had not tested > properly the patch I got. > > If everything goes well I'll attach