Fedora alert FEDORA-2013-5548 (plexus-archiver)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 18 Update: plexus-archiver-2.3-1.fc18 | |
| Date: | Sat, 11 May 2013 00:27:50 +0000 | |
| Message-ID: | <20130511002749.E9B33209C0@bastion01.phx2.fedoraproject.org> | |
| Archive‑link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2013-5548 2013-04-12 21:37:27 -------------------------------------------------------------------------------- Name : plexus-archiver Product : Fedora 18 Version : 2.3 Release : 1.fc18 URL : http://plexus.codehaus.org/plexus-components/plexus-archi... Summary : Plexus Archiver Component Description : The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage. -------------------------------------------------------------------------------- Update Information: Rebase to upstream version 2.3 and add patch to fix CVE-2012-2098. -------------------------------------------------------------------------------- ChangeLog: * Thu Apr 11 2013 Mikolaj Izdebski <mizdebsk@redhat.com> - 0:2.3-1 - Update to upstream version 2.3 - Use apache-commons-compress for bzip2 (de)compression - Resolves: CVE-2012-2098 * Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0:2.2-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild * Wed Feb 6 2013 Java SIG <java-devel@lists.fedoraproject.org> - 0:2.2-5 - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild - Replace maven BuildRequires with maven-local * Fri Nov 23 2012 Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.2-4 - Add ASL 2.0 license text to packages * Thu Nov 22 2012 Jaromir Capik <jcapik@redhat.com> - 0:2.2-3 - Migration to plexus-containers-container-default * Mon Nov 19 2012 Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.2-2 - Fix source URL to be stable * Wed Oct 10 2012 Alexander Kurtakov <akurtako@redhat.com> 0:2.2-1 - Update to upstream 2.2. -------------------------------------------------------------------------------- References: [ 1 ] Bug #951522 - plexus-archiver: Uses embedded bzip implementation from apache-commons-compress (making it vulnerable against CVE-2012-2098 flaw and possibly others) https://bugzilla.redhat.com/show_bug.cgi?id=951522 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update plexus-archiver' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...