You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jackrabbit.apache.org by re...@apache.org on 2026/10/07 15:31:08 UTC
(jackrabbit-site) branch main updated (7c335433 -> 8c4b986b)
This is an automated email from the ASF dual-hosted git repository.
reschke pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/jackrabbit-site.git
from 7c335433 CVEs
new 7ee1c0c0 link CVEs on security page
new 8c4b986b link CVEs on welcome and download pages
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
src/site/markdown/downloads.md | 6 +++---
src/site/markdown/index.md | 6 +++---
src/site/markdown/security-reports.md | 16 ++++++++--------
3 files changed, 14 insertions(+), 14 deletions(-)
(jackrabbit-site) 02/02: link CVEs on welcome and download pages
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reschke pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/jackrabbit-site.git
commit 8c4b986b4a5fab505ef768e7ccf9bece02d3512e
Author: Julian Reschke <ju...@gmx.de>
AuthorDate: Wed Oct 7 16:30:57 2026 +0100
link CVEs on welcome and download pages
---
src/site/markdown/downloads.md | 6 +++---
src/site/markdown/index.md | 6 +++---
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/src/site/markdown/downloads.md b/src/site/markdown/downloads.md
index 009e9d2f..3f6527a2 100644
--- a/src/site/markdown/downloads.md
+++ b/src/site/markdown/downloads.md
@@ -57,7 +57,7 @@ Jackrabbit trunk, with a focus on new features and other
improvements. For production use we recommend the latest 2.22.x
release.
-*This release addresses CVE-2026-92414 and CVE-2026-92415*.
+*This release addresses [CVE-2026-92414](https://www.cve.org/CVERecord?id=CVE-2026-92414) and [CVE-2026-92415](https://www.cve.org/CVERecord?id=CVE-2026-92415)*.
See the [full release notes](https://www.apache.org/dist/jackrabbit/2.23.6-beta/RELEASE-NOTES.txt) for more details.
@@ -83,7 +83,7 @@ Apache Jackrabbit 2.22.5 is an incremental feature release based on
and compatible with earlier stable Jackrabbit 2.x releases. Jackrabbit
2.22.x releases are considered stable and targeted for production use.
-*This release addresses CVE-2026-92414 and CVE-2026-92415*.
+*This release addresses [CVE-2026-92414](https://www.cve.org/CVERecord?id=CVE-2026-92414) and [CVE-2026-92415](https://www.cve.org/CVERecord?id=CVE-2026-92415)*.
See the [full release notes](https://www.apache.org/dist/jackrabbit/2.22.5/RELEASE-NOTES.txt) for more details.
@@ -109,7 +109,7 @@ Apache Jackrabbit 2.20.18 is an incremental feature release based on
and compatible with earlier stable Jackrabbit 2.x releases. Jackrabbit
2.20.x releases are considered stable and targeted for production use.
-*This release addresses CVE-2026-92414 and CVE-2026-92415*.
+*This release addresses [CVE-2026-92414](https://www.cve.org/CVERecord?id=CVE-2026-92414) and [CVE-2026-92415](https://www.cve.org/CVERecord?id=CVE-2026-92415)*.
See the [full release notes](https://www.apache.org/dist/jackrabbit/2.20.18/RELEASE-NOTES.txt) for more details.
diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md
index f903d941..a90f5ed2 100644
--- a/src/site/markdown/index.md
+++ b/src/site/markdown/index.md
@@ -41,21 +41,21 @@ Apache Jackrabbit 2.23.6-beta is an unstable release cut directly from trunk, wi
focus on new features and other improvements. See the
[downloads](downloads.html#v2.23) page for more details.
-*This release addresses CVE-2026-92414 and CVE-2026-92415*.
+*This release addresses [CVE-2026-92414](https://www.cve.org/CVERecord?id=CVE-2026-92414) and [CVE-2026-92415](https://www.cve.org/CVERecord?id=CVE-2026-92415)*.
#### 2026-10-07: Apache Jackrabbit 2.22.5 released
Apache Jackrabbit 2.22.5 is an incremental feature release based on and
compatible with earlier stable Jackrabbit 2.x releases. See the
[downloads](downloads.html#v2.22) page for more details.
-*This release addresses CVE-2026-92414 and CVE-2026-92415*.
+*This release addresses [CVE-2026-92414](https://www.cve.org/CVERecord?id=CVE-2026-92414) and [CVE-2026-92415](https://www.cve.org/CVERecord?id=CVE-2026-92415)*.
#### 2025-10-07: Apache Jackrabbit 2.20.18 released
Apache Jackrabbit 2.20.18 is an incremental feature release based on and
compatible with earlier stable Jackrabbit 2.x releases. See the
[downloads](downloads.html#v2.20) page for more details.
-*This release addresses CVE-2026-92414 and CVE-2026-92415*.
+*This release addresses [CVE-2026-92414](https://www.cve.org/CVERecord?id=CVE-2026-92414) and [CVE-2026-92415](https://www.cve.org/CVERecord?id=CVE-2026-92415)*.
#### 2026-08-06: Apache Jackrabbit 2.22.4 released
Apache Jackrabbit 2.22.4 is an incremental feature release based on and
(jackrabbit-site) 01/02: link CVEs on security page
Posted by re...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
reschke pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/jackrabbit-site.git
commit 7ee1c0c021a43a112c984b208aed26ff0fce8530
Author: Julian Reschke <ju...@gmx.de>
AuthorDate: Wed Oct 7 16:28:15 2026 +0100
link CVEs on security page
---
src/site/markdown/security-reports.md | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/src/site/markdown/security-reports.md b/src/site/markdown/security-reports.md
index f30c951c..4107d145 100644
--- a/src/site/markdown/security-reports.md
+++ b/src/site/markdown/security-reports.md
@@ -30,14 +30,14 @@ announcement and a short description.
| CVE Number | Type | Fix Versions |
|---------------|--------------------------------------------------|-----------------------------------------------------------------|
-| CVE-2009-0026 | Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp. | 1.5.2 |
-| CVE-2015-1833 | XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request. | 2.2.14, 2.4.6, 2.6.6, 2.8.1, 2.10.1 |
-| CVE-2016-6801 | Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header. | 2.4.6, 2.6.6, 2.8.3, 2.10.4, 2 [...]
-| CVE-2023-37895 | Apache Jackrabbit RMI access can lead to RCE | 2.20.11, 2.21.18 |
-| CVE-2025-53689 | Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges | 2.23.1-beta, 2.22.1, 2.20.17 |
-| CVE-2025-58782 | JNDI injection risk with JndiRepositoryFactory | 2.22.2 |
-| CVE-2026-92414 | Pre-auth hijack of cached sessions via derivable WebDAV lock tokens | 2.20.18, 2.22.5, 2.23.6-beta |
-| CVE-2026-92415 | DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies | 2.20.18, 2.22.5, 2.23.6-beta |
+| [CVE-2009-0026](https://www.cve.org/CVERecord?id=CVE-2009-0026) | Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp. | 1.5.2 |
+| [CVE-2015-1833](https://www.cve.org/CVERecord?id=CVE-2015-1833) | XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request. | 2.2.14, 2.4.6, 2.6.6, 2.8.1, 2.10.1 |
+| [CVE-2016-6801](https://www.cve.org/CVERecord?id=CVE-2016-6801) | Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Con [...]
+| [CVE-2023-37895](https://www.cve.org/CVERecord?id=CVE-2023-37895) | Apache Jackrabbit RMI access can lead to RCE | 2.20.11, 2.21.18 |
+| [CVE-2025-53689](https://www.cve.org/CVERecord?id=CVE-2025-53689) | Blind XXE Vulnerabilities in jackrabbit-spi-commons and jackrabbit-core in Apache Jackrabbit < 2.23.2 due to usage of an unsecured document build to load privileges | 2.23.1-beta, 2.22.1, 2.20.17 |
+| [CVE-2025-58782](https://www.cve.org/CVERecord?id=CVE-2025-58782) | JNDI injection risk with JndiRepositoryFactory | 2.22.2 |
+| [CVE-2026-92414](https://www.cve.org/CVERecord?id=CVE-2026-92414) | Pre-auth hijack of cached sessions via derivable WebDAV lock tokens | 2.20.18, 2.22.5, 2.23.6-beta |
+| [CVE-2026-92415](https://www.cve.org/CVERecord?id=CVE-2026-92415) | DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies | 2.20.18, 2.22.5, 2.23.6-beta |
### Jackrabbit's Security Model