You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by sv...@apache.org on 2026/10/07 15:20:50 UTC
svn commit: r1938859 - jackrabbit/site/live/jcr
Author: svn-site-role
Date: Wed Oct 7 15:20:50 2026
New Revision: 1938859
Log:
@trivial: Site checkin for project Apache Jackrabbit Site-1.0-SNAPSHOT
Modified:
jackrabbit/site/live/jcr/downloads.html
jackrabbit/site/live/jcr/index.html
jackrabbit/site/live/jcr/security-reports.html
Modified: jackrabbit/site/live/jcr/downloads.html
==============================================================================
--- jackrabbit/site/live/jcr/downloads.html Wed Oct 7 14:20:49 2026 (r1938858)
+++ jackrabbit/site/live/jcr/downloads.html Wed Oct 7 15:20:50 2026 (r1938859)
@@ -236,6 +236,7 @@ Apache Jackrabbit 2.23.6-beta (2026-10-0
Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest 2.22.x
release.</p>
+<p><i>This release addresses CVE-2026-92414 and CVE-2026-92415</i>.</p>
<p>See the <a class="externalLink" href="https://www.apache.org/dist/jackrabbit/2.23.6-beta/RELEASE-NOTES.txt">full release notes</a> for more details.</p>
<ul>
@@ -265,6 +266,7 @@ Apache Jackrabbit 2.22.5 (2026-10-07)</h
<p>Apache Jackrabbit 2.22.5 is an incremental feature release based on
and compatible with earlier stable Jackrabbit 2.x releases. Jackrabbit
2.22.x releases are considered stable and targeted for production use.</p>
+<p><i>This release addresses CVE-2026-92414 and CVE-2026-92415</i>.</p>
<p>See the <a class="externalLink" href="https://www.apache.org/dist/jackrabbit/2.22.5/RELEASE-NOTES.txt">full release notes</a> for more details.</p>
<ul>
@@ -294,6 +296,7 @@ Apache Jackrabbit 2.20.18 (2026-10-07)</
<p>Apache Jackrabbit 2.20.18 is an incremental feature release based on
and compatible with earlier stable Jackrabbit 2.x releases. Jackrabbit
2.20.x releases are considered stable and targeted for production use.</p>
+<p><i>This release addresses CVE-2026-92414 and CVE-2026-92415</i>.</p>
<p>See the <a class="externalLink" href="https://www.apache.org/dist/jackrabbit/2.20.18/RELEASE-NOTES.txt">full release notes</a> for more details.</p>
<ul>
Modified: jackrabbit/site/live/jcr/index.html
==============================================================================
--- jackrabbit/site/live/jcr/index.html Wed Oct 7 14:20:49 2026 (r1938858)
+++ jackrabbit/site/live/jcr/index.html Wed Oct 7 15:20:50 2026 (r1938859)
@@ -202,15 +202,18 @@ more information.</p>
<h4><a name="a2026-10-07:_Apache_Jackrabbit_2.23.6-beta_released"></a>2026-10-07: Apache Jackrabbit 2.23.6-beta released</h4>
<p>Apache Jackrabbit 2.23.6-beta is an unstable release cut directly from trunk, with a
focus on new features and other improvements. See the
-<a href="downloads.html#v2.23">downloads</a> page for more details.</p></section><section>
+<a href="downloads.html#v2.23">downloads</a> page for more details.</p>
+<p><i>This release addresses CVE-2026-92414 and CVE-2026-92415</i>.</p></section><section>
<h4><a name="a2026-10-07:_Apache_Jackrabbit_2.22.5_released"></a>2026-10-07: Apache Jackrabbit 2.22.5 released</h4>
<p>Apache Jackrabbit 2.22.5 is an incremental feature release based on and
compatible with earlier stable Jackrabbit 2.x releases. See the
-<a href="downloads.html#v2.22">downloads</a> page for more details.</p></section><section>
+<a href="downloads.html#v2.22">downloads</a> page for more details.</p>
+<p><i>This release addresses CVE-2026-92414 and CVE-2026-92415</i>.</p></section><section>
<h4><a name="a2025-10-07:_Apache_Jackrabbit_2.20.18_released"></a>2025-10-07: Apache Jackrabbit 2.20.18 released</h4>
<p>Apache Jackrabbit 2.20.18 is an incremental feature release based on and
compatible with earlier stable Jackrabbit 2.x releases. See the
-<a href="downloads.html#v2.20">downloads</a> page for more details.</p></section><section>
+<a href="downloads.html#v2.20">downloads</a> page for more details.</p>
+<p><i>This release addresses CVE-2026-92414 and CVE-2026-92415</i>.</p></section><section>
<h4><a name="a2026-08-06:_Apache_Jackrabbit_2.22.4_released"></a>2026-08-06: Apache Jackrabbit 2.22.4 released</h4>
<p>Apache Jackrabbit 2.22.4 is an incremental feature release based on and
compatible with earlier stable Jackrabbit 2.x releases. See the
Modified: jackrabbit/site/live/jcr/security-reports.html
==============================================================================
--- jackrabbit/site/live/jcr/security-reports.html Wed Oct 7 14:20:49 2026 (r1938858)
+++ jackrabbit/site/live/jcr/security-reports.html Wed Oct 7 15:20:50 2026 (r1938859)
@@ -226,6 +226,14 @@ announcement and a short description.</p
<td align="left">CVE-2025-58782</td>
<td>JNDI injection risk with JndiRepositoryFactory</td>
<td>2.22.2</td></tr>
+<tr class="b">
+<td align="left">CVE-2026-92414</td>
+<td>Pre-auth hijack of cached sessions via derivable WebDAV lock tokens</td>
+<td>2.20.18, 2.22.5, 2.23.6-beta</td></tr>
+<tr class="a">
+<td align="left">CVE-2026-92415</td>
+<td>DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies</td>
+<td>2.20.18, 2.22.5, 2.23.6-beta</td></tr>
</tbody>
</table></section></section><section>
<h3><a name="Jackrabbit.27s_Security_Model"></a>Jackrabbit's Security Model</h3>