gora-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Lewis John McGibbney (JIRA)" <j...@apache.org>
Subject [jira] [Resolved] (GORA-250) [SECURITY] Frame injection vulnerability in published Javadoc
Date Fri, 15 Aug 2014 18:01:22 GMT

     [ https://issues.apache.org/jira/browse/GORA-250?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Lewis John McGibbney resolved GORA-250.
---------------------------------------

    Resolution: Fixed
      Assignee: Lewis John McGibbney  (was: Henry Saputra)

lmcgibbn@LMC-032857 /usr/local/gora_cms/trunk/content/current/api(master) $ svn ci -m "GORA-250
[SECURITY] Frame injection vulnerability in published Javadoc"
Sending        apidocs-0.2/index.html
Sending        apidocs-0.2.1/index.html
Sending        apidocs-0.3/index.html
Transmitting file data ...
Committed revision 1618249.

> [SECURITY] Frame injection vulnerability in published Javadoc
> -------------------------------------------------------------
>
>                 Key: GORA-250
>                 URL: https://issues.apache.org/jira/browse/GORA-250
>             Project: Apache Gora
>          Issue Type: New Feature
>          Components: documentation
>    Affects Versions: 0.3
>            Reporter: Lewis John McGibbney
>            Assignee: Lewis John McGibbney
>            Priority: Blocker
>             Fix For: 0.5
>
>
> Hi All,
> Oracle has announced [1], [2] a frame injection vulnerability in Javadoc
> generated by Java 5, Java 6 and Java 7 before update 22.
> The infrastructure team has completed a scan of our current project
> websites and identified over 6000 instances of vulnerable Javadoc
> distributed across most TLPs. The chances are the project(s) you
> contribute to is(are) affected. A list of projects and the number of
> affected Javadoc instances per project is provided at the end of this
> e-mail.
> Please take the necessary steps to fix any currently published Javadoc
> and to ensure that any future Javadoc published by your project does not
> contain the vulnerability. The announcement by Oracle includes a link to
> a tool that can be used to fix Javadoc without regeneration.
> The infrastructure team is investigating options for preventing the
> publication of vulnerable Javadoc.
> [1]
> http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
> [2] http://www.kb.cert.org/vuls/id/225657
> gora.apache.org         3



--
This message was sent by Atlassian JIRA
(v6.2#6252)

Mime
View raw message