You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomee.apache.org by Jean-Louis Monteiro <jl...@tomitribe.com> on 2014/04/30 23:19:57 UTC
CXF advisories
Hello guys,
Please check this page
http://cxf.apache.org/security-advisories.html
The 4 latest ones have been discovered recently, so we should plan a
1.6.0.2 soon if we are also using CXF vulnerable binaries, isn't it?
--
Jean-Louis Monteiro
http://twitter.com/jlouismonteiro
http://www.tomitribe.com
Re: CXF advisories
Posted by Romain Manni-Bucau <rm...@gmail.com>.
Ok but first our build should be green (seems some regressions were
introduced in some modules - surely only in tests)
Romain Manni-Bucau
Twitter: @rmannibucau
Blog: http://rmannibucau.wordpress.com/
LinkedIn: http://fr.linkedin.com/in/rmannibucau
Github: https://github.com/rmannibucau
2014-05-01 12:24 GMT+02:00 Andy Gumbrecht <ag...@tomitribe.com>:
> That's what I mean, let's get these minor version changes in and tested over
> the next few days - If a build fails then spend no time on it, and revert.
>
> There is a complete list attached, and I am not saying all...just the most
> obvious ones!
>
>
> On 01/05/2014 11:36, Romain Manni-Bucau wrote:
>>
>> I'd report it for a 1.7.1 since it is very risky - we sometimes rely
>> on some particular versions regarding the behavior for advanced cases
>> - and 1.7.0 is really expected.
>>
>> >From what I saw (quickly) ehcache, slf4j, geronimo_javamail, [lang3],
>> [fileupload] can be updated almost blindy (I mean if build passes
>> that's ok). Others looks too dangerous at this moment for me.
>>
>> Wdyt?
>>
>>
>> Romain Manni-Bucau
>> Twitter: @rmannibucau
>> Blog: http://rmannibucau.wordpress.com/
>> LinkedIn: http://fr.linkedin.com/in/rmannibucau
>> Github: https://github.com/rmannibucau
>>
>>
>> 2014-05-01 11:19 GMT+02:00 Andy Gumbrecht <ag...@tomitribe.com>:
>>>
>>> The buildbot is up and there are a few 'minor' fails.
>>> I'd like to get as many minor version lib updates into 1.7.0 as possible
>>> before release:
>>>
>>> mvn
>>> org.codehaus.mojo:versions-maven-plugin:2.1:display-dependency-updates =
>>> Quite a lot of updates to test against...
>>>
>>>
>>> On 01/05/2014 10:46, Romain Manni-Bucau wrote:
>>>>
>>>> seems consistent
>>>>
>>>> side note: we should release 1.7.0 too - it is due for weeks - not
>>>> sure the status on openjpa side.
>>>>
>>>>
>>>> Romain Manni-Bucau
>>>> Twitter: @rmannibucau
>>>> Blog: http://rmannibucau.wordpress.com/
>>>> LinkedIn: http://fr.linkedin.com/in/rmannibucau
>>>> Github: https://github.com/rmannibucau
>>>>
>>>>
>>>> 2014-05-01 10:38 GMT+02:00 Andy Gumbrecht <ag...@tomitribe.com>:
>>>>>
>>>>> +1
>>>>>
>>>>> Andy.
>>>>>
>>>>>
>>>>> On 30/04/2014 23:19, Jean-Louis Monteiro wrote:
>>>>>>
>>>>>> Hello guys,
>>>>>>
>>>>>> Please check this page
>>>>>> http://cxf.apache.org/security-advisories.html
>>>>>>
>>>>>> The 4 latest ones have been discovered recently, so we should plan a
>>>>>> 1.6.0.2 soon if we are also using CXF vulnerable binaries, isn't it?
>>>>>>
>>>>>> --
>>>>>> Jean-Louis Monteiro
>>>>>> http://twitter.com/jlouismonteiro
>>>>>> http://www.tomitribe.com
>>>>>>
>>>>> --
>>>>> Andy Gumbrecht
>>>>>
>>>>> http://www.tomitribe.com
>>>>> agumbrecht@tomitribe.com
>>>>> https://twitter.com/AndyGeeDe
>>>>>
>>>>> TomEE treibt Tomitribe! | http://tomee.apache.org
>>>>>
>>> --
>>> Andy Gumbrecht
>>>
>>> http://www.tomitribe.com
>>> agumbrecht@tomitribe.com
>>> https://twitter.com/AndyGeeDe
>>>
>>> TomEE treibt Tomitribe! | http://tomee.apache.org
>>>
>>
>
> --
> Andy Gumbrecht
>
> http://www.tomitribe.com
> agumbrecht@tomitribe.com
> https://twitter.com/AndyGeeDe
>
> TomEE treibt Tomitribe! | http://tomee.apache.org
>
Re: CXF advisories
Posted by Andy Gumbrecht <ag...@tomitribe.com>.
That's what I mean, let's get these minor version changes in and tested
over the next few days - If a build fails then spend no time on it, and
revert.
There is a complete list attached, and I am not saying all...just the
most obvious ones!
On 01/05/2014 11:36, Romain Manni-Bucau wrote:
> I'd report it for a 1.7.1 since it is very risky - we sometimes rely
> on some particular versions regarding the behavior for advanced cases
> - and 1.7.0 is really expected.
>
> >From what I saw (quickly) ehcache, slf4j, geronimo_javamail, [lang3],
> [fileupload] can be updated almost blindy (I mean if build passes
> that's ok). Others looks too dangerous at this moment for me.
>
> Wdyt?
>
>
> Romain Manni-Bucau
> Twitter: @rmannibucau
> Blog: http://rmannibucau.wordpress.com/
> LinkedIn: http://fr.linkedin.com/in/rmannibucau
> Github: https://github.com/rmannibucau
>
>
> 2014-05-01 11:19 GMT+02:00 Andy Gumbrecht <ag...@tomitribe.com>:
>> The buildbot is up and there are a few 'minor' fails.
>> I'd like to get as many minor version lib updates into 1.7.0 as possible
>> before release:
>>
>> mvn org.codehaus.mojo:versions-maven-plugin:2.1:display-dependency-updates =
>> Quite a lot of updates to test against...
>>
>>
>> On 01/05/2014 10:46, Romain Manni-Bucau wrote:
>>> seems consistent
>>>
>>> side note: we should release 1.7.0 too - it is due for weeks - not
>>> sure the status on openjpa side.
>>>
>>>
>>> Romain Manni-Bucau
>>> Twitter: @rmannibucau
>>> Blog: http://rmannibucau.wordpress.com/
>>> LinkedIn: http://fr.linkedin.com/in/rmannibucau
>>> Github: https://github.com/rmannibucau
>>>
>>>
>>> 2014-05-01 10:38 GMT+02:00 Andy Gumbrecht <ag...@tomitribe.com>:
>>>> +1
>>>>
>>>> Andy.
>>>>
>>>>
>>>> On 30/04/2014 23:19, Jean-Louis Monteiro wrote:
>>>>> Hello guys,
>>>>>
>>>>> Please check this page
>>>>> http://cxf.apache.org/security-advisories.html
>>>>>
>>>>> The 4 latest ones have been discovered recently, so we should plan a
>>>>> 1.6.0.2 soon if we are also using CXF vulnerable binaries, isn't it?
>>>>>
>>>>> --
>>>>> Jean-Louis Monteiro
>>>>> http://twitter.com/jlouismonteiro
>>>>> http://www.tomitribe.com
>>>>>
>>>> --
>>>> Andy Gumbrecht
>>>>
>>>> http://www.tomitribe.com
>>>> agumbrecht@tomitribe.com
>>>> https://twitter.com/AndyGeeDe
>>>>
>>>> TomEE treibt Tomitribe! | http://tomee.apache.org
>>>>
>> --
>> Andy Gumbrecht
>>
>> http://www.tomitribe.com
>> agumbrecht@tomitribe.com
>> https://twitter.com/AndyGeeDe
>>
>> TomEE treibt Tomitribe! | http://tomee.apache.org
>>
>
--
Andy Gumbrecht
http://www.tomitribe.com
agumbrecht@tomitribe.com
https://twitter.com/AndyGeeDe
TomEE treibt Tomitribe! | http://tomee.apache.org
Re: CXF advisories
Posted by Romain Manni-Bucau <rm...@gmail.com>.
I'd report it for a 1.7.1 since it is very risky - we sometimes rely
on some particular versions regarding the behavior for advanced cases
- and 1.7.0 is really expected.
>From what I saw (quickly) ehcache, slf4j, geronimo_javamail, [lang3],
[fileupload] can be updated almost blindy (I mean if build passes
that's ok). Others looks too dangerous at this moment for me.
Wdyt?
Romain Manni-Bucau
Twitter: @rmannibucau
Blog: http://rmannibucau.wordpress.com/
LinkedIn: http://fr.linkedin.com/in/rmannibucau
Github: https://github.com/rmannibucau
2014-05-01 11:19 GMT+02:00 Andy Gumbrecht <ag...@tomitribe.com>:
> The buildbot is up and there are a few 'minor' fails.
> I'd like to get as many minor version lib updates into 1.7.0 as possible
> before release:
>
> mvn org.codehaus.mojo:versions-maven-plugin:2.1:display-dependency-updates =
> Quite a lot of updates to test against...
>
>
> On 01/05/2014 10:46, Romain Manni-Bucau wrote:
>>
>> seems consistent
>>
>> side note: we should release 1.7.0 too - it is due for weeks - not
>> sure the status on openjpa side.
>>
>>
>> Romain Manni-Bucau
>> Twitter: @rmannibucau
>> Blog: http://rmannibucau.wordpress.com/
>> LinkedIn: http://fr.linkedin.com/in/rmannibucau
>> Github: https://github.com/rmannibucau
>>
>>
>> 2014-05-01 10:38 GMT+02:00 Andy Gumbrecht <ag...@tomitribe.com>:
>>>
>>> +1
>>>
>>> Andy.
>>>
>>>
>>> On 30/04/2014 23:19, Jean-Louis Monteiro wrote:
>>>>
>>>> Hello guys,
>>>>
>>>> Please check this page
>>>> http://cxf.apache.org/security-advisories.html
>>>>
>>>> The 4 latest ones have been discovered recently, so we should plan a
>>>> 1.6.0.2 soon if we are also using CXF vulnerable binaries, isn't it?
>>>>
>>>> --
>>>> Jean-Louis Monteiro
>>>> http://twitter.com/jlouismonteiro
>>>> http://www.tomitribe.com
>>>>
>>> --
>>> Andy Gumbrecht
>>>
>>> http://www.tomitribe.com
>>> agumbrecht@tomitribe.com
>>> https://twitter.com/AndyGeeDe
>>>
>>> TomEE treibt Tomitribe! | http://tomee.apache.org
>>>
>>
>
> --
> Andy Gumbrecht
>
> http://www.tomitribe.com
> agumbrecht@tomitribe.com
> https://twitter.com/AndyGeeDe
>
> TomEE treibt Tomitribe! | http://tomee.apache.org
>
Re: CXF advisories
Posted by Andy Gumbrecht <ag...@tomitribe.com>.
The buildbot is up and there are a few 'minor' fails.
I'd like to get as many minor version lib updates into 1.7.0 as possible
before release:
mvn
org.codehaus.mojo:versions-maven-plugin:2.1:display-dependency-updates =
Quite a lot of updates to test against...
On 01/05/2014 10:46, Romain Manni-Bucau wrote:
> seems consistent
>
> side note: we should release 1.7.0 too - it is due for weeks - not
> sure the status on openjpa side.
>
>
> Romain Manni-Bucau
> Twitter: @rmannibucau
> Blog: http://rmannibucau.wordpress.com/
> LinkedIn: http://fr.linkedin.com/in/rmannibucau
> Github: https://github.com/rmannibucau
>
>
> 2014-05-01 10:38 GMT+02:00 Andy Gumbrecht <ag...@tomitribe.com>:
>> +1
>>
>> Andy.
>>
>>
>> On 30/04/2014 23:19, Jean-Louis Monteiro wrote:
>>> Hello guys,
>>>
>>> Please check this page
>>> http://cxf.apache.org/security-advisories.html
>>>
>>> The 4 latest ones have been discovered recently, so we should plan a
>>> 1.6.0.2 soon if we are also using CXF vulnerable binaries, isn't it?
>>>
>>> --
>>> Jean-Louis Monteiro
>>> http://twitter.com/jlouismonteiro
>>> http://www.tomitribe.com
>>>
>> --
>> Andy Gumbrecht
>>
>> http://www.tomitribe.com
>> agumbrecht@tomitribe.com
>> https://twitter.com/AndyGeeDe
>>
>> TomEE treibt Tomitribe! | http://tomee.apache.org
>>
>
--
Andy Gumbrecht
http://www.tomitribe.com
agumbrecht@tomitribe.com
https://twitter.com/AndyGeeDe
TomEE treibt Tomitribe! | http://tomee.apache.org
Re: CXF advisories
Posted by Jean-Louis Monteiro <jl...@tomitribe.com>.
+1 for 1.7.0 if everything is ready for Java 8
--
Jean-Louis Monteiro
http://twitter.com/jlouismonteiro
http://www.tomitribe.com
On Thu, May 1, 2014 at 10:46 AM, Romain Manni-Bucau
<rm...@gmail.com>wrote:
> seems consistent
>
> side note: we should release 1.7.0 too - it is due for weeks - not
> sure the status on openjpa side.
>
>
> Romain Manni-Bucau
> Twitter: @rmannibucau
> Blog: http://rmannibucau.wordpress.com/
> LinkedIn: http://fr.linkedin.com/in/rmannibucau
> Github: https://github.com/rmannibucau
>
>
> 2014-05-01 10:38 GMT+02:00 Andy Gumbrecht <ag...@tomitribe.com>:
> > +1
> >
> > Andy.
> >
> >
> > On 30/04/2014 23:19, Jean-Louis Monteiro wrote:
> >>
> >> Hello guys,
> >>
> >> Please check this page
> >> http://cxf.apache.org/security-advisories.html
> >>
> >> The 4 latest ones have been discovered recently, so we should plan a
> >> 1.6.0.2 soon if we are also using CXF vulnerable binaries, isn't it?
> >>
> >> --
> >> Jean-Louis Monteiro
> >> http://twitter.com/jlouismonteiro
> >> http://www.tomitribe.com
> >>
> >
> > --
> > Andy Gumbrecht
> >
> > http://www.tomitribe.com
> > agumbrecht@tomitribe.com
> > https://twitter.com/AndyGeeDe
> >
> > TomEE treibt Tomitribe! | http://tomee.apache.org
> >
>
Re: CXF advisories
Posted by Romain Manni-Bucau <rm...@gmail.com>.
seems consistent
side note: we should release 1.7.0 too - it is due for weeks - not
sure the status on openjpa side.
Romain Manni-Bucau
Twitter: @rmannibucau
Blog: http://rmannibucau.wordpress.com/
LinkedIn: http://fr.linkedin.com/in/rmannibucau
Github: https://github.com/rmannibucau
2014-05-01 10:38 GMT+02:00 Andy Gumbrecht <ag...@tomitribe.com>:
> +1
>
> Andy.
>
>
> On 30/04/2014 23:19, Jean-Louis Monteiro wrote:
>>
>> Hello guys,
>>
>> Please check this page
>> http://cxf.apache.org/security-advisories.html
>>
>> The 4 latest ones have been discovered recently, so we should plan a
>> 1.6.0.2 soon if we are also using CXF vulnerable binaries, isn't it?
>>
>> --
>> Jean-Louis Monteiro
>> http://twitter.com/jlouismonteiro
>> http://www.tomitribe.com
>>
>
> --
> Andy Gumbrecht
>
> http://www.tomitribe.com
> agumbrecht@tomitribe.com
> https://twitter.com/AndyGeeDe
>
> TomEE treibt Tomitribe! | http://tomee.apache.org
>
Re: CXF advisories
Posted by Andy Gumbrecht <ag...@tomitribe.com>.
+1
Andy.
On 30/04/2014 23:19, Jean-Louis Monteiro wrote:
> Hello guys,
>
> Please check this page
> http://cxf.apache.org/security-advisories.html
>
> The 4 latest ones have been discovered recently, so we should plan a
> 1.6.0.2 soon if we are also using CXF vulnerable binaries, isn't it?
>
> --
> Jean-Louis Monteiro
> http://twitter.com/jlouismonteiro
> http://www.tomitribe.com
>
--
Andy Gumbrecht
http://www.tomitribe.com
agumbrecht@tomitribe.com
https://twitter.com/AndyGeeDe
TomEE treibt Tomitribe! | http://tomee.apache.org