You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@marmotta.apache.org by Sergio Fernández <wi...@apache.org> on 2013/06/23 12:18:10 UTC
Fwd: [SECURITY] Frame injection vulnerability in published Javadoc
We might take a look how to patch our javadoc...
I'd need to confirm it, but since we are using builbot with maven,
assuming a patched jdk version is used there, we'd just need to
re-publish the site. As soon as I confirm this, I'll come back.
-------- Original Message --------
Subject: [SECURITY] Frame injection vulnerability in published Javadoc
Date: Thu, 20 Jun 2013 09:29:23 +0100
From: Mark Thomas <ma...@apache.org>
Reply-To: infrastructure@apache.org <in...@apache.org>
To: committers@apache.org
CC: root@apache.org
Hi All,
Oracle has announced [1], [2] a frame injection vulnerability in Javadoc
generated by Java 5, Java 6 and Java 7 before update 22.
The infrastructure team has completed a scan of our current project
websites and identified over 6000 instances of vulnerable Javadoc
distributed across most TLPs. The chances are the project(s) you
contribute to is(are) affected. A list of projects and the number of
affected Javadoc instances per project is provided at the end of this
e-mail.
Please take the necessary steps to fix any currently published Javadoc
and to ensure that any future Javadoc published by your project does not
contain the vulnerability. The announcement by Oracle includes a link to
a tool that can be used to fix Javadoc without regeneration.
The infrastructure team is investigating options for preventing the
publication of vulnerable Javadoc.
The issue is public and may be discussed freely on your project's dev list.
Thanks,
Mark (ASF Infra)
[1]
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
[2] http://www.kb.cert.org/vuls/id/225657
Project Instances
abdera.apache.org 1
accumulo.apache.org 2
activemq.apache.org 105
any23.apache.org 13
archiva.apache.org 4
archive.apache.org 13
aries.apache.org 7
avro.apache.org 23
axis.apache.org 5
beehive.apache.org 16
bval.apache.org 12
camel.apache.org 786
cayenne.apache.org 4
chemistry.apache.org 6
click.apache.org 3
cocoon.apache.org 6
commons.apache.org 34
continuum.apache.org 9
creadur.apache.org 19
crunch.apache.org 4
ctakes.apache.org 2
curator.apache.org 4
cxf.apache.org 6
db.apache.org 39
directory.apache.org 4
empire-db.apache.org 1
felix.apache.org 5
flume.apache.org 5
geronimo.apache.org 241
giraph.apache.org 6
gora.apache.org 3
hadoop.apache.org 21
hbase.apache.org 2
hive.apache.org 4
hivemind.apache.org 10
incubator.apache.org 355
jackrabbit.apache.org 9
jakarta.apache.org 39
james.apache.org 53
jena.apache.org 5
juddi.apache.org 3
lenya.apache.org 46
logging.apache.org 111
lucene.apache.org 713
manifoldcf.apache.org 112
marmotta.apache.org 1
maven.apache.org 1623
maventest.apache.org 1178
mina.apache.org 2
mrunit.apache.org 3
myfaces.apache.org 348
nutch.apache.org 8
oltu.apache.org 11
oodt.apache.org 1
ooo-site.apache.org 1
oozie.apache.org 10
openjpa.apache.org 20
opennlp.apache.org 9
pdfbox.apache.org 1
pig.apache.org 7
pivot.apache.org 1
poi.apache.org 1
portals.apache.org 35
river.apache.org 2
santuario.apache.org 1
shale.apache.org 55
shiro.apache.org 3
sling.apache.org 2
sqoop.apache.org 4
struts.apache.org 190
subversion.apache.org 3
synapse.apache.org 1
syncope.apache.org 2
tapestry.apache.org 6
tika.apache.org 9
tiles.apache.org 12
turbine.apache.org 100
tuscany.apache.org 4
uima.apache.org 12
velocity.apache.org 41
whirr.apache.org 2
wicket.apache.org 3
wink.apache.org 13
ws.apache.org 22
xalan.apache.org 1
xerces.apache.org 5
xml.apache.org 1
xmlbeans.apache.org 3
zookeeper.apache.org 18
--
Sergio Fernández
Salzburg Research
+43 662 2288 318
Jakob-Haringer Strasse 5/II
A-5020 Salzburg (Austria)
http://www.salzburgresearch.at
--
Sergio Fernández
Re: Fwd: [SECURITY] Frame injection vulnerability in published Javadoc
Posted by Andy Seaborne <an...@apache.org>.
On 24/06/13 11:50, Sergio Fernández wrote:
> Hi,
>
> On 23/06/13 19:06, Andy Seaborne wrote:
>> On 23/06/13 11:18, Sergio Fernández wrote:
>>> We might take a look how to patch our javadoc...
>>>
>>> I'd need to confirm it, but since we are using builbot with maven,
>>> assuming a patched jdk version is used there, we'd just need to
>>> re-publish the site. As soon as I confirm this, I'll come back.
>
> The bug has been solve in the plugin:
>
> https://jira.codehaus.org/browse/MJAVADOC-370
>
> and it is now available for version 2.10-SNAPSHOT.
>
> But this is not very helpful right now since maven looks for the javadoc
> binary based on the JAVA_HOME, which in ci.apache.org still points to
> java6, even if you try to force java7 from the maven-compiler-plugin :-/
>
>> For Jena, I patched the already-generated javadoc in-place and
>> republished the site.
>
> How do you edit the generated javadoc? I think for me there are still so
> many things to learn about the Apache CMS...
The Jena site is in CMS - the javadoc is in as pure HTML even if the
site is markdown.
Andy
>
> BTW, the issue with the reports should be fixed:
>
> http://jira.codehaus.org/browse/MSHARED-271
>
> Later I'd try to find time for working on this.
>
> Cheers,
>
>
Re: Fwd: [SECURITY] Frame injection vulnerability in published Javadoc
Posted by Sergio Fernández <se...@salzburgresearch.at>.
Hi,
On 23/06/13 19:06, Andy Seaborne wrote:
> On 23/06/13 11:18, Sergio Fernández wrote:
>> We might take a look how to patch our javadoc...
>>
>> I'd need to confirm it, but since we are using builbot with maven,
>> assuming a patched jdk version is used there, we'd just need to
>> re-publish the site. As soon as I confirm this, I'll come back.
The bug has been solve in the plugin:
https://jira.codehaus.org/browse/MJAVADOC-370
and it is now available for version 2.10-SNAPSHOT.
But this is not very helpful right now since maven looks for the javadoc
binary based on the JAVA_HOME, which in ci.apache.org still points to
java6, even if you try to force java7 from the maven-compiler-plugin :-/
> For Jena, I patched the already-generated javadoc in-place and
> republished the site.
How do you edit the generated javadoc? I think for me there are still so
many things to learn about the Apache CMS...
BTW, the issue with the reports should be fixed:
http://jira.codehaus.org/browse/MSHARED-271
Later I'd try to find time for working on this.
Cheers,
--
Sergio Fernández
Salzburg Research
+43 662 2288 318
Jakob-Haringer Strasse 5/II
A-5020 Salzburg (Austria)
http://www.salzburgresearch.at
Re: Fwd: [SECURITY] Frame injection vulnerability in published Javadoc
Posted by Andy Seaborne <an...@apache.org>.
On 23/06/13 11:18, Sergio Fernández wrote:
> We might take a look how to patch our javadoc...
>
> I'd need to confirm it, but since we are using builbot with maven,
> assuming a patched jdk version is used there, we'd just need to
> re-publish the site. As soon as I confirm this, I'll come back.
For Jena, I patched the already-generated javadoc in-place and
republished the site.
Andy