This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/sis-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new eaeda3e2 Modification to release notes of SIS 1.7 with links to CVEs.
eaeda3e2 is described below
commit eaeda3e22a651892e464f217365957d06613fdda
Author: Martin Desruisseaux <[email protected]>
AuthorDate: Mon Nov 2 12:20:40 2026 +0100
Modification to release notes of SIS 1.7 with links to CVEs.
---
index.xml | 2 +-
release-notes/1.7.html | 10 ++++++++--
release-notes/index.xml | 2 +-
sitemap.xml | 2 +-
4 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/index.xml b/index.xml
index d64656d3..d6bbb755 100644
--- a/index.xml
+++ b/index.xml
@@ -345,7 +345,7 @@
<link>https://sis.apache.org/release-notes/1.7.html</link>
<pubDate>Mon, 01 Jan 0001 00:00:00
+0000</pubDate>
<guid>https://sis.apache.org/release-notes/1.7.html</guid>
- <description><ul>
<li>Release
date: <strong>2026-10-13</strong></li>
<li>Next
release</li>
<li><a
href="./release-notes/1.6.html">Previous
release</a></li>
<li><a
href="./release-notes/1.7.html#compatibility">Incompatible
changes</a></li>
<li><a
href="./release-notes/1.7.html#issues">Noticeable
changes</a></li>
<li>Req [...]
+ <description><ul>
<li>Release
date: <strong>2026-10-13</strong></li>
<li>Next
release</li>
<li><a
href="./release-notes/1.6.html">Previous
release</a></li>
<li><a
href="./release-notes/1.7.html#compatibility">Incompatible
changes</a></li>
<li><a
href="./release-notes/1.7.html#issues">Noticeable
changes</a></li>
<li>Req [...]
</item>
<item>
<title>Standards implemented by Apache
SIS</title>
diff --git a/release-notes/1.7.html b/release-notes/1.7.html
index c3536b62..7ede0e26 100644
--- a/release-notes/1.7.html
+++ b/release-notes/1.7.html
@@ -74,11 +74,17 @@ Note that when Apache SIS opens another file, it tries to
parse it as GML, GeoTI
format and fails at the first error. Therefore, these vulnerabilities are
unlikely to leak sensitive
information (unless passwords are saved as TIFF images…).</p>
<ul>
+<li><a
href="https://www.cve.org/CVERecord?id=CVE-2026-110748";>CVE-2026-110748</a> —
+Improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files
+<ul>
<li>CWE-918 SSRF and local-file disclosure via <code>xlink:href</code>
resolution during XML unmarshalling (reporters: n0mi1k, Ho1aAs).</li>
<li>CWE-918 SSRF via datum-shift grid-file references such as URI parameter in
WKT (reporters: n0mi1k, Ho1aAs).</li>
<li>CWE-22 path traversal / arbitrary file read via Landsat metadata band
filenames (reporters: n0mi1k, Ho1aAs).</li>
+</ul>
+</li>
+<li><a
href="https://www.cve.org/CVERecord?id=CVE-2026-110733";>CVE-2026-110733</a> —
+SQL injection via unvalidated <code>ORDER BY</code> sort expression in the SQL
feature store (reporter: Ho1aAs).</li>
<li>CWE-770 unbounded memory allocation in the binary file parsers (netCDF +
GeoTIFF) leading to DoS (reporter: n0mi1k).</li>
-<li>SQL injection via unvalidated <code>ORDER BY</code> sort expression in the
SQL feature store (reporter: Ho1aAs).</li>
</ul>
<p>The following vulnerability has not been fixed by code.
Instead, it is addressed by documenting recommendations:</p>
@@ -87,7 +93,7 @@ Instead, it is addressed by documenting recommendations:</p>
</ul>
<p>See the <a
href="https://github.com/apache/sis/blob/main/SECURITY.md";>Security Policy</a>
for recommendations about how to use Apache SIS in a security-sensitive
context.
-Thanks to “n0mi1k Security” and to Ho1aAs (GitHub: @HolaAsuka) for
these reports.</p>
+Thanks to <code>n0mi1k</code> and to <code>Ho1aAs</code> (GitHub:
<code>@HolaAsuka</code>) for these reports.</p>
<h1 id="compatibility">Incompatible changes</h1>
<p>The following changes in Apache SIS 1.7 are incompatibles with the previous
release (SIS 1.6):</p>
<ul>
diff --git a/release-notes/index.xml b/release-notes/index.xml
index da459dbe..bd07be0f 100644
--- a/release-notes/index.xml
+++ b/release-notes/index.xml
@@ -121,7 +121,7 @@
<link>https://sis.apache.org/release-notes/1.7.html</link>
<pubDate>Mon, 01 Jan 0001 00:00:00
+0000</pubDate>
<guid>https://sis.apache.org/release-notes/1.7.html</guid>
- <description><ul>
<li>Release
date: <strong>2026-10-13</strong></li>
<li>Next
release</li>
<li><a
href="../release-notes/1.6.html">Previous
release</a></li>
<li><a
href="../release-notes/1.7.html#compatibility">Incompatible
changes</a></li>
<li><a
href="../release-notes/1.7.html#issues">Noticeable
changes</a></li>
<li> [...]
+ <description><ul>
<li>Release
date: <strong>2026-10-13</strong></li>
<li>Next
release</li>
<li><a
href="../release-notes/1.6.html">Previous
release</a></li>
<li><a
href="../release-notes/1.7.html#compatibility">Incompatible
changes</a></li>
<li><a
href="../release-notes/1.7.html#issues">Noticeable
changes</a></li>
<li> [...]
</item>
</channel>
</rss>
diff --git a/sitemap.xml b/sitemap.xml
index 7aebfcdc..93a73592 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -151,7 +151,7 @@
<lastmod>2026-10-09T22:58:02+02:00</lastmod>
</url><url>
<loc>https://sis.apache.org/release-notes/1.7.html</loc>
- <lastmod>2026-10-09T22:58:02+02:00</lastmod>
+ <lastmod>2026-11-02T12:13:41+01:00</lastmod>
</url><url>
<loc>https://sis.apache.org/standards.html</loc>
<lastmod>2025-09-28T16:53:40+02:00</lastmod>
