Author: brett
Date: Fri Jan 11 03:39:44 2013
New Revision: 1431866
URL: http://svn.apache.org/viewvc?rev=1431866&view=rev
Log:
Apache Archiva Main site deployment
Modified:
archiva/site-content/download.html
archiva/site-content/security.html
Modified: archiva/site-content/download.html
URL:
http://svn.apache.org/viewvc/archiva/site-content/download.html?rev=1431866&r1=1431865&r2=1431866&view=diff
==============================================================================
--- archiva/site-content/download.html (original)
+++ archiva/site-content/download.html Fri Jan 11 03:39:44 2013
@@ -304,6 +304,7 @@ under the License. -->
</p><ul>
<li><a href="./docs/1.3.6/release-notes.html">Release
Notes</a></li>
<li><a href="./known-issues.html">Known Issues and Errata</a></li>
+ <li><a href="./security.html">Security Reports</a></li>
</ul>
<p>
@@ -359,6 +360,7 @@ under the License. -->
</p><ul>
<li><a href="./docs/1.4-M3/release-notes.html">Release
Notes</a></li>
<li><a href="./known-issues.html">Known Issues and
Errata</a></li>
+ <li><a href="./security.html">Security Reports</a></li>
</ul>
<p>
Modified: archiva/site-content/security.html
URL:
http://svn.apache.org/viewvc/archiva/site-content/security.html?rev=1431866&r1=1431865&r2=1431866&view=diff
==============================================================================
--- archiva/site-content/security.html (original)
+++ archiva/site-content/security.html Fri Jan 11 03:39:44 2013
@@ -212,7 +212,7 @@ pageTracker._trackPageview();</script>
<div id="bodyColumn" >
- <!-- Licensed to the Apache Software Foundation (ASF) under one
--><!-- or more contributor license agreements. See the NOTICE file --><!--
distributed with this work for additional information --><!-- regarding
copyright ownership. The ASF licenses this file --><!-- to you under the
Apache License, Version 2.0 (the --><!-- "License"); you may not use this file
except in compliance --><!-- with the License. You may obtain a copy of the
License at --><!-- --><!-- http://www.apache.org/licenses/LICENSE-2.0 --><!--
--><!-- Unless required by applicable law or agreed to in writing, --><!--
software distributed under the License is distributed on an --><!-- "AS IS"
BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY --><!-- KIND, either express or
implied. See the License for the --><!-- specific language governing
permissions and limitations --><!-- under the License. --><!-- NOTE: For help
with the syntax of this file, see: --><!-- http://maven.apache.org/guides/mi
ni/guide-apt-format.html --><div class="section"><h2>Security
Vulnerabilities<a name="Security_Vulnerabilities"></a></h2><p>Please note that
binary patches are not produced for individual vulnerabilities. To obtain the
binary fix for a particular vulnerability you should upgrade to an Apache
Archiva version where that vulnerability has been fixed.</p><p>For more
information about reporting vulnerabilities, see the <a class="externalLink"
href="http://www.apache.org/security/";> Apache Security Team</a> page.</p><div
class="section"><h3>CVE-2010-1870: Struts2 remote commands execution<a
name="CVE-2010-1870:_Struts2_remote_commands_execution"></a></h3><p>Apache
Archiva is affected by a vulnerability in the version of the Struts library
being used, which allows a malicious user to run code on the server remotely.
More details about the vulnerability can be found at <a class="externalLink"
href="http://struts.apache.org/2.2.1/docs/s2-005.html";>http://struts.apache.org/2.2.1/docs/
s2-005.html</a>.</p><p>Versions Affected:</p><ul><li>Archiva 1.2 to Archiva
1.3.5</li></ul><p>All users are recommended to upgrade to <a
href="./download.cgi"> Archiva 1.3.6</a>, which configures Struts in such a way
that it is not affected by this issue.</p><p>Archiva 1.4-M3 and later is not
affected by this issue.</p></div><div class="section"><h3>CVE-2011-1077:
Multiple XSS issues<a
name="CVE-2011-1077:_Multiple_XSS_issues"></a></h3><p>Apache Archiva is
vulnerable to multiple XSS issues, both stored (persistent) and reflected
(non-persistent). Javascript which might contain malicious code can be appended
in a request parameter or stored as a value in a submitted form, and get
executed.</p><p>Versions Affected:</p><ul><li>Archiva 1.3 - 1.3.4</li><li>The
unsupported versions Archiva 1.0 - 1.2.2 are also affected.</li></ul></div><div
class="section"><h3>CVE-2011-1026: Multiple CSRF issues<a
name="CVE-2011-1026:_Multiple_CSRF_issues"></a></h3><p>An attacker can build a
simple
html page containing a hidden Image tag (eg: <tt><img src=vulnurl width=0
height=0 /</tt>>) and entice the administrator to access the
page.</p><p>Versions Affected:</p><ul><li>Archiva 1.3 - 1.3.4</li><li>The
unsupported versions Archiva 1.0 - 1.2.2 are also affected.</li></ul></div><div
class="section"><h3>CVE-2011-0533: Apache Archiva cross-site scripting
vulnerability<a
name="CVE-2011-0533:_Apache_Archiva_cross-site_scripting_vulnerability"></a></h3><p>A
request that included a specially crafted request parameter could be used to
inject arbitrary HTML or Javascript into the Archiva user management page. This
fix is available in version <a href="./download.html"> 1.3.4</a> of Apache
Archiva. All users must upgrade to this version (or higher).</p><p>Versions
Affected:</p><ul><li>Archiva 1.3 - 1.3.3</li><li>The unsupported versions
Archiva 1.0 - 1.2.2 are also affected.</li></ul></div><div
class="section"><h3>CVE-2010-3449: Apache Archiva CSRF Vulnerability<a name="CV
E-2010-3449:_Apache_Archiva_CSRF_Vulnerability"></a></h3><p>Apache Archiva
doesn't check which form sends credentials. An attacker can create a specially
crafted page and force archiva administrators to view it and change their
credentials. To fix this, a referrer check was added to the security
interceptor for all secured actions. A prompt for the administrator's password
when changing a user account was also set in place. This fix is available in
version <a href="./download.html"> 1.3.2</a> of Apache Archiva. All users must
upgrade to this version (or higher).</p><p>Versions
Affected:</p><ul><li>Archiva 1.3 to 1.3.1</li><li>Archiva 1.2 to 1.2.2 (end of
life)</li><li>Archiva 1.1 to 1.1.4 (end of life)</li><li>Archiva 1.0 to 1.0.3
(end of life)</li></ul></div></div>
+ <!-- Licensed to the Apache Software Foundation (ASF) under one
--><!-- or more contributor license agreements. See the NOTICE file --><!--
distributed with this work for additional information --><!-- regarding
copyright ownership. The ASF licenses this file --><!-- to you under the
Apache License, Version 2.0 (the --><!-- "License"); you may not use this file
except in compliance --><!-- with the License. You may obtain a copy of the
License at --><!-- --><!-- http://www.apache.org/licenses/LICENSE-2.0 --><!--
--><!-- Unless required by applicable law or agreed to in writing, --><!--
software distributed under the License is distributed on an --><!-- "AS IS"
BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY --><!-- KIND, either express or
implied. See the License for the --><!-- specific language governing
permissions and limitations --><!-- under the License. --><!-- NOTE: For help
with the syntax of this file, see: --><!-- http://maven.apache.org/guides/mi
ni/guide-apt-format.html --><div class="section"><h2>Security
Vulnerabilities<a name="Security_Vulnerabilities"></a></h2><p>Please note that
binary patches are not produced for individual vulnerabilities. To obtain the
binary fix for a particular vulnerability you should upgrade to an Apache
Archiva version where that vulnerability has been fixed.</p><p>For more
information about reporting vulnerabilities, see the <a class="externalLink"
href="http://www.apache.org/security/";> Apache Security Team</a> page.</p><div
class="section"><h3>CVE-2010-1870: Struts2 remote commands execution<a
name="CVE-2010-1870:_Struts2_remote_commands_execution"></a></h3><p>Apache
Archiva is affected by a vulnerability in the version of the Struts library
being used, which allows a malicious user to run code on the server remotely.
More details about the vulnerability can be found at <a class="externalLink"
href="http://struts.apache.org/2.2.1/docs/s2-005.html";>http://struts.apache.org/2.2.1/docs/
s2-005.html</a>.</p><p>Versions Affected:</p><ul><li>Archiva 1.3 to Archiva
1.3.5</li></ul><ul><li>The unsupported versions Archiva 1.2 to 1.2.2 are also
affected.</li></ul><p>All users are recommended to upgrade to <a
href="./download.cgi"> Archiva 1.3.6</a>, which configures Struts in such a way
that it is not affected by this issue.</p><p>Archiva 1.4-M3 and later is not
affected by this issue.</p></div><div class="section"><h3>CVE-2011-1077:
Multiple XSS issues<a
name="CVE-2011-1077:_Multiple_XSS_issues"></a></h3><p>Apache Archiva is
vulnerable to multiple XSS issues, both stored (persistent) and reflected
(non-persistent). Javascript which might contain malicious code can be appended
in a request parameter or stored as a value in a submitted form, and get
executed.</p><p>Versions Affected:</p><ul><li>Archiva 1.3 to 1.3.4</li><li>The
unsupported versions Archiva 1.0 to 1.2.2 are also
affected.</li></ul></div><div class="section"><h3>CVE-2011-1026: Multiple CSRF
issues<a n
ame="CVE-2011-1026:_Multiple_CSRF_issues"></a></h3><p>An attacker can build a
simple html page containing a hidden Image tag (eg: <tt><img src=vulnurl
width=0 height=0 /</tt>>) and entice the administrator to access the
page.</p><p>Versions Affected:</p><ul><li>Archiva 1.3 to 1.3.4</li><li>The
unsupported versions Archiva 1.0 to 1.2.2 are also
affected.</li></ul></div><div class="section"><h3>CVE-2011-0533: Apache Archiva
cross-site scripting vulnerability<a
name="CVE-2011-0533:_Apache_Archiva_cross-site_scripting_vulnerability"></a></h3><p>A
request that included a specially crafted request parameter could be used to
inject arbitrary HTML or Javascript into the Archiva user management page. This
fix is available in version <a href="./download.html"> 1.3.4</a> of Apache
Archiva. All users must upgrade to this version (or higher).</p><p>Versions
Affected:</p><ul><li>Archiva 1.3 to 1.3.3</li><li>The unsupported versions
Archiva 1.0 to 1.2.2 are also affected.</li></ul></
div><div class="section"><h3>CVE-2010-3449: Apache Archiva CSRF
Vulnerability<a
name="CVE-2010-3449:_Apache_Archiva_CSRF_Vulnerability"></a></h3><p>Apache
Archiva doesn't check which form sends credentials. An attacker can create a
specially crafted page and force archiva administrators to view it and change
their credentials. To fix this, a referrer check was added to the security
interceptor for all secured actions. A prompt for the administrator's password
when changing a user account was also set in place. This fix is available in
version <a href="./download.html"> 1.3.2</a> of Apache Archiva. All users must
upgrade to this version (or higher).</p><p>Versions
Affected:</p><ul><li>Archiva 1.3 to 1.3.1</li><li>Archiva 1.2 to 1.2.2 (end of
life)</li><li>Archiva 1.1 to 1.1.4 (end of life)</li><li>Archiva 1.0 to 1.0.3
(end of life)</li></ul></div></div>
</div>
</div>
