You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@tiles.apache.org by Nicolas LE BAS <ma...@nlebas.net> on 2013/06/22 17:26:36 UTC

[SECURITY] Frame injection vulnerability in published Javadoc

Hi all,

Since it is a urgent security matter, I've completed the task and I'm
asking for approval of the PMC after the deed. Thanks for your
understanding.

I applied the patch provided by Oracle and published the result
immediately.

The affected files were:

tiles-showcase/apidocs/index.html
eval/apidocs/index.html
2.0/framework/apidocs/index.html
2.0/framework/testapidocs/index.html
framework/apidocs/index.html
framework/testapidocs/index.html
tiles-autotag/apidocs/index.html
tiles-request/apidocs/index.html
2.1/framework/apidocs/index.html
2.1/framework/testapidocs/index.html
2.2/framework/apidocs/index.html
2.2/framework/testapidocs/index.html

Please know that any comments will be considered with attention.

Thanks,

Nick.

-------- Original Message --------
Subject: [SECURITY] Frame injection vulnerability in published Javadoc

Hi All,

Oracle has announced [1], [2] a frame injection vulnerability in Javadoc
generated by Java 5, Java 6 and Java 7 before update 22.

[...]

[1]
http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
[2] http://www.kb.cert.org/vuls/id/225657

Project			Instances
[...]
tiles.apache.org	12
[...]

Re: [SECURITY] Frame injection vulnerability in published Javadoc

Posted by Greg Reddin <gr...@gmail.com>.

Thanks, Nicolas.


On Sat, Jun 22, 2013 at 10:26 AM, Nicolas LE BAS <ma...@nlebas.net> wrote:

> Hi all,
>
> Since it is a urgent security matter, I've completed the task and I'm
> asking for approval of the PMC after the deed. Thanks for your
> understanding.
>
> I applied the patch provided by Oracle and published the result
> immediately.
>
> The affected files were:
>
> tiles-showcase/apidocs/index.html
> eval/apidocs/index.html
> 2.0/framework/apidocs/index.html
> 2.0/framework/testapidocs/index.html
> framework/apidocs/index.html
> framework/testapidocs/index.html
> tiles-autotag/apidocs/index.html
> tiles-request/apidocs/index.html
> 2.1/framework/apidocs/index.html
> 2.1/framework/testapidocs/index.html
> 2.2/framework/apidocs/index.html
> 2.2/framework/testapidocs/index.html
>
> Please know that any comments will be considered with attention.
>
> Thanks,
>
> Nick.
>
> -------- Original Message --------
> Subject: [SECURITY] Frame injection vulnerability in published Javadoc
>
> Hi All,
>
> Oracle has announced [1], [2] a frame injection vulnerability in Javadoc
> generated by Java 5, Java 6 and Java 7 before update 22.
>
> [...]
>
> [1]
>
> http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
> [2] http://www.kb.cert.org/vuls/id/225657
>
> Project                 Instances
> [...]
> tiles.apache.org        12
> [...]
>
>
>
>

Re: [SECURITY] Frame injection vulnerability in published Javadoc

Posted by Mick Semb Wever <mc...@apache.org>.

ClamAV 0.96.5


> I applied the patch provided by Oracle and published the result
> immediately.

Thanks Nicolas!

I've made a commit to tiles-master to help us address this problem
further. see http://svn.apache.org/r1495885

It uses the enforcer plugin to limit which jdks can be used to build the
project. Since there is no safe version of Java6 the enforcer plugin
sets it to 1.7.0-22+

A previous problem was our javadoc building currently only worked with
Java6 due to UmlGraph. It has been upgraded, it now works with Java7.

I've also set the minimum maven version to use to 3.0.4.

If this makes sense i'll push for a release of tiles-master-6 soon.

Maybe we should also be dropping support for Java6 compatibility?

~mck


-- 
Just because a person smiles all the time doesn't mean their life is
perfect. That smile is a symbol of hope & strength. 

| http://github.com/finn-no | http://tech.finn.no |