Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 1 articles for you...
100
security advisorymoderateSUSESUSE: 2024:1304-1 Moderate: XML Attack Fix in Eclipse and Maven-Surefire
* bsc#1216992 Cross-References: * CVE-2023-4218 . # Security update for eclipse, maven-surefire, tycho Announcement ID: SUSE-SU-2024:1304-1 Rating: moderate References: * bsc#1216992 Cross-References: * CVE-2023-4218 CVSS scores: * CVE-2023-4218 ( SUSE ): 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N * CVE-2023-4218 ( NVD ): 5.0 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Affected Products: * Development Tools Module 15-SP5 * openSUSE Leap 15.5 * SUSE Enterprise Storage 7.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability can now be installed. ## Description: This update for eclipse, maven-surefire, tycho fixes the following issues: eclipse received the following security fix: * CVE-2023-4218: Fixed a bug whereparsing files with xml content laeds to XXE attacks. (bsc#1216992) maven-sunfire was updated from version 2.22.0 to 2.22.2: * Changes in version 2.22.2: * Bugs fixed: * Fixed JUnit Runner that writes to System.out corrupts Surefireâs STDOUT when using JUnitâs Vintage Engine * Changes in version 2.22.1: * Bugs fixed: * Fixed Surefire unable to run testng suites in parallel * Fixed Git wrongly considering PNG files as changed when there is no change * Fixed the surefire XSD published on maven site lacking of some rerun element * Fixed XML Report elements rerunError, rerunFailure, flakyFailure, flakyError * Fixed overriding platform version through project/plugin dependencies * Fixed mixed up characters in standard output * Logs in Parallel Tests are mixed up when `forkMode=never` or `forkCount=0` * MIME type for javascript is now officially application/javascript * Improvements: * Elapsed time in XML Report should satisfy pattern in XSD. * Fix old test resources TEST-*.xml in favor of continuing with SUREFIRE-1550 * Nil element âfailureMessageâ in failsafe-summary.xml should have self closed tag * Removed obsolete module `surefire-setup-integration-tests` * Support Java 11 * Surefire should support parameterized reportsDirectory * Dependency upgrades: * Upgraded maven-plugins parent to version 32 * Upgraded maven-plugins parent to version 33 tycho received the following bug fixes: * Fixed build against maven-surefire 2.22.1 and newer * Fixed build against newer plexus-compiler * Fixed issues with plexus-archiver 4.4.0 and newer * Require explicitely artifacts that will not be required automatically any more ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patchSUSE-SLE-Product-SLES-15-SP3-LTSS-2024-1304=1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-1304=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-1304=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-1304=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-1304=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2024-1304=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-1304=1 * Development Tools Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP5-2024-1304=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-1304=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-1304=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-1304=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-1304=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-1304=1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 zypper in -t patch SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-1304=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-1304=1 ## Package List: * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 *maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Enterprise Storage 7.1 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * eclipse-platform-debuginfo-4.15-150200.4.16.4 * eclipse-swt-debuginfo-4.15-150200.4.16.4 * eclipse-swt-4.15-150200.4.16.4 * eclipse-swt-bootstrap-4.15-150200.4.16.5 * eclipse-platform-4.15-150200.4.16.4 * eclipse-bootstrap-debuginfo-4.15-150200.4.16.5 * eclipse-emf-core-2.22.0-150200.4.9.3 * eclipse-emf-core-bootstrap-2.22.0-150200.4.9.3 * eclipse-equinox-osgi-4.15-150200.4.16.4 * eclipse-swt-bootstrap-debuginfo-4.15-150200.4.16.5 * eclipse-pde-bootstrap-4.15-150200.4.16.5 * eclipse-contributor-tools-4.15-150200.4.16.4 * eclipse-platform-bootstrap-4.15-150200.4.16.5 * eclipse-platform-bootstrap-debuginfo-4.15-150200.4.16.5 * eclipse-debuginfo-4.15-150200.4.16.4 * eclipse-bootstrap-debugsource-4.15-150200.4.16.5 * eclipse-pde-4.15-150200.4.16.4 * eclipse-equinox-osgi-bootstrap-4.15-150200.4.16.5 * eclipse-debugsource-4.15-150200.4.16.4 * openSUSE Leap 15.5 (noarch) * eclipse-emf-xsd-2.22.0-150200.4.9.3 * eclipse-p2-discovery-4.15-150200.4.16.4 * maven-failsafe-plugin-bootstrap-2.22.2-150200.3.9.9.1 * maven-surefire-report-parser-2.22.2-150200.3.9.9.1 * tycho-javadoc-1.6.0-150200.4.9.5 * tycho-1.6.0-150200.4.9.5 * maven-surefire-plugin-bootstrap-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * eclipse-emf-sdk-2.22.0-150200.4.9.3 * maven-surefire-javadoc-2.22.2-150200.3.9.9.1 * eclipse-p2-discovery-bootstrap-4.15-150200.4.16.5 * eclipse-jdt-bootstrap-4.15-150200.4.16.5 * maven-surefire-report-plugin-bootstrap-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-plugins-javadoc-2.22.2-150200.3.9.9.1 * eclipse-emf-runtime-2.22.0-150200.4.9.3 * maven-surefire-provider-junit5-javadoc-2.22.2-150200.3.9.9.1 * eclipse-jdt-4.15-150200.4.16.4 * tycho-bootstrap-1.6.0-150200.4.9.2 * maven-surefire-report-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit5-2.22.2-150200.3.9.9.1 * maven-surefire-2.22.2-150200.3.9.9.1 * maven-failsafe-plugin-2.22.2-150200.3.9.9.1 * Development Tools Module 15-SP5 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * eclipse-platform-debuginfo-4.15-150200.4.16.4 * eclipse-swt-debuginfo-4.15-150200.4.16.4 *eclipse-swt-4.15-150200.4.16.4 * eclipse-swt-bootstrap-4.15-150200.4.16.5 * eclipse-platform-4.15-150200.4.16.4 * eclipse-bootstrap-debuginfo-4.15-150200.4.16.5 * eclipse-emf-core-2.22.0-150200.4.9.3 * eclipse-emf-core-bootstrap-2.22.0-150200.4.9.3 * eclipse-equinox-osgi-4.15-150200.4.16.4 * eclipse-swt-bootstrap-debuginfo-4.15-150200.4.16.5 * eclipse-pde-bootstrap-4.15-150200.4.16.5 * eclipse-contributor-tools-4.15-150200.4.16.4 * eclipse-platform-bootstrap-4.15-150200.4.16.5 * eclipse-platform-bootstrap-debuginfo-4.15-150200.4.16.5 * eclipse-debuginfo-4.15-150200.4.16.4 * eclipse-bootstrap-debugsource-4.15-150200.4.16.5 * eclipse-pde-4.15-150200.4.16.4 * eclipse-equinox-osgi-bootstrap-4.15-150200.4.16.5 * eclipse-debugsource-4.15-150200.4.16.4 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (noarch) *maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * maven-surefire-2.22.2-150200.3.9.9.1 * maven-surefire-plugin-2.22.2-150200.3.9.9.1 * maven-surefire-provider-junit-2.22.2-150200.3.9.9.1 * maven-surefire-provider-testng-2.22.2-150200.3.9.9.1 ## References: * https://www.suse.com/security/cve/CVE-2023-4218.html * https://bugzilla.suse.com/show_bug.cgi?id=1216992 . Patch notification for IntelliJ, Gradle, and JBoss tackles CVE-2023-4219 issues rated as moderate.. SUSE Linux Update, Eclipse Security Fix, Maven Surefire Update, Tycho Bug Fix. . LinuxSecurity.com Team
Apr 16, 2024
SuSE
203
security advisorysecurity issueauthenticationMageia 8: 2021-0591 Moderate: Eclipse Help Request Authentication Issue
Authenticate active help requests to the local help web server (CVE-2020-27225) References: - https://bugs.mageia.org/show_bug.cgi?id=29048 . MGASA-2021-0591 - Updated eclipse packages fix security vulnerability Publication date: 30 Dec 2021 URL: https://advisories.mageia.org/MGASA-2021-0591.html Type: security Affected Mageia releases: 8 CVE: CVE-2020-27225 Authenticate active help requests to the local help web server (CVE-2020-27225) References: - https://bugs.mageia.org/show_bug.cgi?id=29048 - - https://www.cve.org/CVERecord?id=CVE-2020-27225 SRPMS: - 8/core/eclipse-4.17-8.1.mga8 . Updates to Eclipse packages have been released to address a vulnerability concerning help requests authenticated to local servers.. security Advisory, Eclipse Update, Mageia Release. . LinuxSecurity.com Team
Dec 30, 2021
Mageia
202
security advisorysecurity issueauthenticationopenSUSE Leap 15.2: 2021:0485-1 Important Authentication Issue
An update that fixes one vulnerability is now available. . openSUSE Security Update: Security update for eclipse ______________________________________________________________________________ Announcement ID: openSUSE-SU-2021:0485-1 Rating: important References: #1183728 Cross-References: CVE-2020-27225 Affected Products: openSUSE Leap 15.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This update for eclipse fixes the following issues: - CVE-2020-27225: Authenticate active help requests to the local help web server (bsc#1183728). This update was imported from the SUSE:SLE-15-SP2:Update update project. Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 15.2: zypper in -t patch openSUSE-2021-485=1 Package List: - openSUSE Leap 15.2 (x86_64): eclipse-bootstrap-debuginfo-4.9.0-lp152.3.3.1 eclipse-bootstrap-debugsource-4.9.0-lp152.3.3.1 eclipse-contributor-tools-4.9.0-lp152.3.3.1 eclipse-contributor-tools-bootstrap-4.9.0-lp152.3.3.1 eclipse-debuginfo-4.9.0-lp152.3.3.1 eclipse-debugsource-4.9.0-lp152.3.3.1 eclipse-equinox-osgi-4.9.0-lp152.3.3.1 eclipse-equinox-osgi-bootstrap-4.9.0-lp152.3.3.1 eclipse-pde-4.9.0-lp152.3.3.1 eclipse-pde-bootstrap-4.9.0-lp152.3.3.1 eclipse-platform-4.9.0-lp152.3.3.1 eclipse-platform-bootstrap-4.9.0-lp152.3.3.1 eclipse-platform-bootstrap-debuginfo-4.9.0-lp152.3.3.1 eclipse-platform-debuginfo-4.9.0-lp152.3.3.1 eclipse-swt-4.9.0-lp152.3.3.1 eclipse-swt-bootstrap-4.9.0-lp152.3.3.1 eclipse-swt-bootstrap-debuginfo-4.9.0-lp152.3.3.1 eclipse-swt-debuginfo-4.9.0-lp152.3.3.1 eclipse-tests-4.9.0-lp152.3.3.1 eclipse-tests-bootstrap-4.9.0-lp152.3.3.1 - openSUSE Leap 15.2 (noarch): eclipse-jdt-4.9.0-lp152.3.3.1 eclipse-jdt-bootstrap-4.9.0-lp152.3.3.1 eclipse-p2-discovery-4.9.0-lp152.3.3.1 eclipse-p2-discovery-bootstrap-4.9.0-lp152.3.3.1 References: https://www.suse.com/security/cve/CVE-2020-27225.html https://bugzilla.suse.com/1183728 . Important openSUSE Security Upgrade for LibreOffice fixes a significant data integrity issue with remediation techniques.. openSUSE Security,Eclipse Update,Authentication Issues,Security Patch. . Severity: Important. LinuxSecurity.com Team
Mar 30, 2021
•Important
OpenSUSE
197
security advisorydebianremote accessDebian LTS DLA-2404-1: Eclipse WTP Remote File Exposure Threat
In Eclipse Web Tools Platform, a component of the Eclipse IDE, XML and DTD files referring to external entities could be exploited to send the contents of local files to a remote server when edited or validated, even when external entity resolution is disabled in the user . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2404-1
Oct 09, 2020
•Critical
Debian LTS
89
security advisoryFedorasecurity fixFedora 32: FEDORA-2020-cf8ef2f333 Moderate: Eclipse Security Fix
Updates to the latest upstream release of Eclipse. See the upstream release notes for details: https://eclipseide.org/release/noteworthy/ Also contains security fixes for CVE-2019-17566 and CVE-2019-17638.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-cf8ef2f333 2020-08-31 15:48:37.485399 --------------------------------------------------------------------------------Name : eclipse-mpc Product : Fedora 32 Version : 1.8.3 Release : 2.fc32 URL : https://projects.eclipse.org/projects/technology.packaging.mpc Summary : Eclipse Marketplace Client Description : The Eclipse Marketplace Client provides access to extension catalogs. --------------------------------------------------------------------------------Update Information: Updates to the latest upstream release of Eclipse. See the upstream release notes for details: https://eclipseide.org/release/noteworthy/ Also contains security fixes for CVE-2019-17566 and CVE-2019-17638. --------------------------------------------------------------------------------ChangeLog: * Mon Jul 27 2020 Fedora Release Engineering - 1.8.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Mon Jun 22 2020 Mat Booth - 1.8.3-1 - Update to latest upstream release * Sun Mar 22 2020 Mat Booth - 1.8.2-1 - Update to latest upstream release - Remove useless dep on maven-enforcer --------------------------------------------------------------------------------References: [ 1 ] Bug #1848617 - CVE-2019-17566 batik: SSRF via "xlink:href" https://bugzilla.redhat.com/show_bug.cgi?id=1848617 [ 2 ] Bug #1864680 - CVE-2019-17638 jetty: double release of resource can lead to information disclosure https://bugzilla.redhat.com/show_bug.cgi?id=1864680 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade--advisory FEDORA-2020-cf8ef2f333' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Aug 31, 2020
Fedora
89
security advisorysecurity issueupdateFedora 32: 2020-cf8ef2f333 Moderate: Eclipse Double Release Issue
Updates to the latest upstream release of Eclipse. See the upstream release notes for details: https://eclipseide.org/release/noteworthy/ Also contains security fixes for CVE-2019-17566 and CVE-2019-17638.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-cf8ef2f333 2020-08-31 15:48:37.485399 --------------------------------------------------------------------------------Name : eclipse Product : Fedora 32 Version : 4.16 Release : 11.fc32 URL : https://www.eclipse.org/ Summary : An open, extensible IDE Description : The Eclipse platform is designed for building integrated development environments (IDEs), server-side applications, desktop applications, and everything in between. --------------------------------------------------------------------------------Update Information: Updates to the latest upstream release of Eclipse. See the upstream release notes for details: https://eclipseide.org/release/noteworthy/ Also contains security fixes for CVE-2019-17566 and CVE-2019-17638. --------------------------------------------------------------------------------ChangeLog: * Fri Aug 21 2020 Mat Booth - 1:4.16-11 - Rebuild with a dependency on obsolete log4j package - Run mvn_install with Java 11 * Wed Aug 19 2020 Mat Booth - 1:4.16-10 - Rebuild against jakarta servlet API and updated batik - Update eclipse-build snapshot * Fri Aug 14 2020 Mat Booth - 1:4.16-9 - Restore explicit glassfish-annotation-api dep * Fri Aug 14 2020 Mat Booth - 1:4.16-8 - Rebuild for new jetty version * Mon Jul 27 2020 Fedora Release Engineering - 1:4.16-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Tue Jul 21 2020 Mat Booth - 1:4.16-6 - Require Java 11 explicitly - Drop hotspot exclusions from the JDK 6 era * Fri Jul 10 2020 Jiri Vanek - 1:4.16-5 - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 * Mon Jun 29 2020 Mat Booth - 1:4.16-4 -Update linux-build snapshot and fix adding junit classpath containers to java projects * Tue Jun 23 2020 Mat Booth - 1:4.16-3 - Make a bit more portable and fix bootstrap mode * Fri Jun 19 2020 Mat Booth - 1:4.16-2 - Non-bootstrap build * Thu Jun 18 2020 Mat Booth - 1:4.16-1 - Update to latest upstream release * Thu Apr 2 2020 Mat Booth - 1:4.15-5 - Make the requirement on felix-scr more strict * Thu Apr 2 2020 Mat Booth - 1:4.15-4 - Allow library detector to build on Java 11 * Sun Mar 29 2020 Mat Booth - 1:4.15-3 - Don't build and ship the test framework. We are not shipping any actual tests anyway and this allows to drop the dependency on mockito and friends. * Mon Mar 23 2020 Mat Booth - 1:4.15-2 - Set compiler release to Java 8 on certain bundles * Sat Mar 21 2020 Mat Booth - 1:4.15-1 - Update to latest upstream release --------------------------------------------------------------------------------References: [ 1 ] Bug #1848617 - CVE-2019-17566 batik: SSRF via "xlink:href" https://bugzilla.redhat.com/show_bug.cgi?id=1848617 [ 2 ] Bug #1864680 - CVE-2019-17638 jetty: double release of resource can lead to information disclosure https://bugzilla.redhat.com/show_bug.cgi?id=1864680 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-cf8ef2f333' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Aug 31, 2020
Fedora
98
security advisoryupdatered hatRed Hat: RHSA-2020:0567-01 Important: Eclipse Vert.x 3.8.5 HTTP Threats
An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat build of Eclipse Vert.x 3.8.5 security update Advisory ID: RHSA-2020:0567-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2020:0567 Issue date: 2020-03-03 CVE Names: CVE-2019-20444 CVE-2019-20445 CVE-2020-7238 ==================================================================== 1. Summary: An update is now available for Red Hat build of Eclipse Vert.x. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section. 2. Description: This release of Red Hat build of Eclipse Vert.x 3.8.5 includes security updates, bug fixes, and enhancements. For more information, see the release notes page listed in the References section. Security Fix(es): * netty: HTTP request smuggling (CVE-2019-20444) * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header (CVE-2019-20445) * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238) For more details about the security issues and their impact, the CVSS score, acknowledgements, and other related information, see the CVE pages listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and databasesettings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. 4. Bugs fixed (https://bugzilla.redhat.com/): 1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling 1798509 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header 1798524 - CVE-2019-20444 netty: HTTP request smuggling 5. References: https://access.redhat.com/security/cve/CVE-2019-20444 https://access.redhat.com/security/cve/CVE-2019-20445 https://access.redhat.com/security/cve/CVE-2020-7238 https://access.redhat.com/security/updates/classification#important https://docs.redhat.com/en/documentation/red_hat_build_of_eclipse_vert.x/3.8/html/release_notes_for_eclipse_vert.x_3.8/index https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.eclipse.vertx&version=3.8.5 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXl6CUdzjgjWX9erEAQgdFw//VvKSTYHvsrJRx3mWp67p+KkYgvT1hjgi 1tSNYZjxhaJVJDwuPaWa6FNAVXRuKoYs69UZ+/u5xU0A6pAc1wiPOJLt9rOSkmZi vNpMafblwsiR1mSxes1pcqBpwU0wbzkuohPK8uZvTbl+m12Cmn0kyTO+8iX0Kspv Fx0dImJQmf5mJkauVdcBQ52KMvWJWpVZnClWsRIhjjigfSxSGp/TzoDhyCwbUZdD UBLzu0hdHerxXmraA0wDgBWyaj5ilIBDsKwaojcgp5H8zNLC1A0IzaVf9VQ6DpaD Oehd+QHF+niFTL9CeWAVwRfSzipUjf/xOKXa67Gu1YiJsXurQLnJ20L9H+KFakig dC2p7JUhRxwiyEu/AHz0wZVrBG+NTWgSxd5VCVQyPGQMGXwnA+YEygqFxbuLYFBV Sec02ky8qwBvlDGqu5UxdJUk9kR5AePvOZfPSDxy6xpWXAXPej8KdBN7waOs0n18 mL3cp8AOAirSQFCnWx4WqRZngBcs0Dy/JuklhoDL3vqbn3O0vcx72oDO6Q+rYk8e jlJ+VIRtPX+MV/ZAiY/YeX4e20qbJQMBI3hvATtHCxNmvGtPu1KJxrCZR9K0v0Cg Wp9/9Ff1ixpM7PFIL89eEN6bPr2g8/Esnhn3hT/woD+HxHKkVkp051rsK5QEF9Rv hfO3eJEBYt8=w8kF -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Mar 03, 2020
•Important
Red Hat
200
security advisorysoftware updatebug fixScientific Linux SL6: 2011-05-19 Important Eclipse XSS Security Update
Low: eclipse security, bug fix, and enhancement update. Date: Mon, 6 Jun 2011 14:46:41 -0500 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA Low: eclipse on SL6.x i386/x86_64 Comments: To: "
Jun 06, 2011
•Important
Scientific Linux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!