This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-neethi.git
The following commit(s) were added to refs/heads/master by this push:
new 52a1c16 Updating website for 3.2.3 release
52a1c16 is described below
commit 52a1c168b156f3ad16fed10fdc0eed1d9f0fed5a
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Fri Jul 24 12:04:54 2026 +0100
Updating website for 3.2.3 release
---
src/site/apt/index.apt | 4 +--
src/site/apt/security.apt | 65 ++++++++++++++++++++++++++++++++++++++++++++++
src/site/xdoc/download.xml | 18 ++++++-------
3 files changed, 76 insertions(+), 11 deletions(-)
diff --git a/src/site/apt/index.apt b/src/site/apt/index.apt
index ff9a957..daabfdb 100644
--- a/src/site/apt/index.apt
+++ b/src/site/apt/index.apt
@@ -28,9 +28,9 @@ Welcome to Apache Neethi
capabilities.
Latest Release
- <<April 2026 - Apache Neethi Version 3.2.2 Released!>>
+ <<July 2026 - Apache Neethi Version 3.2.3 Released!>>
- \[{{{http://ws.apache.org/neethi/download.cgi}Download Neethi 3.2.2}}\]
+ \[{{{http://ws.apache.org/neethi/download.cgi}Download Neethi 3.2.3}}\]
Note that this release fixes three CVEs, please see
{{{./security.html}Security Advisories (CVEs)}}.
diff --git a/src/site/apt/security.apt b/src/site/apt/security.apt
index 6eb90de..98d20c3 100644
--- a/src/site/apt/security.apt
+++ b/src/site/apt/security.apt
@@ -28,6 +28,71 @@ Security and CVE Tracking
Apache Neethi CVEs
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-66144}CVE-2026-66144}}:
+ Apache Neethi: Remote PolicyReference fetch lacks resource bounds
+
+ * Severity: Low
+
+ * Affected versions:
+
+ - Apache Neethi (org.apache.neethi:neethi) before 3.2.3
+
+ * Description:
+
+ Although remote policy references are not retrieved during policy
+ normalization, if they are manually retrieved via the API it can
+ cause a denial of service attack if a huge policy is retrieved.
+ Users are recommended to upgrade to version 3.2.3, which fixes
+ this issue by imposing a default maximum size on data read from
+ remote policy references.
+
+ * Credit:
+
+ Reported by LTSHFWJT (finder)
+
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-66143}CVE-2026-66143}}:
+ Apache Neethi: Missing global alternative-output budget across policy
+ computation paths
+
+ * Severity: Moderate
+
+ * Affected versions:
+
+ - Apache Neethi (org.apache.neethi:neethi) before 3.2.3
+
+ * Description:
+
+ It is possible to bypass the maximum number of normalized policy
+ alternatives that was introduced in Apache Neethi 3.2.2 via certain
+ crafted policies, which may lead to a denial of service attack via
+ resource consumption. Users are recommended to upgrade to version
+ 3.2.3, which fixes this issue.
+
+ * Credit:
+
+ Reported by LTSHFWJT (finder)
+
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-66142}CVE-2026-66142}}:
+ Apache Neethi: Uncontrolled recursion in policy processing
+
+ * Severity: Moderate
+
+ * Affected versions:
+
+ - Apache Neethi (org.apache.neethi:neethi) before 3.2.3
+
+ * Description:
+
+ Apache Neethi is vulnerable to uncontrolled recursion when parsing
+ policies that lack policy Ids or with deeply nested structures,
+ which may lead to a denial of service attack when parsing policies
+ due to runtime memory exhaustion. Users are recommended to upgrade
+ to version 3.2.3, which fixes this issue.
+
+ * Credit:
+
+ Reported by LTSHFWJT (finder)
+
* {{{https://www.cve.org/CVERecord?id=CVE-2026-42404}CVE-2026-42404}}:
Apache Neethi: Unrestricted HTTP Redirect Following in Policy References
diff --git a/src/site/xdoc/download.xml b/src/site/xdoc/download.xml
index e0667bc..a861a7f 100644
--- a/src/site/xdoc/download.xml
+++ b/src/site/xdoc/download.xml
@@ -32,7 +32,7 @@
<section name="Releases">
<div align="left">
- <p>Please select the Apache Neethi version you want to
download. Latest release is 3.2.2. You can download both the binary
distribution and the source distribution. All the releases are available for
download as source or binary. For more information,
+ <p>Please select the Apache Neethi version you want to
download. Latest release is 3.2.3. You can download both the binary
distribution and the source distribution. All the releases are available for
download as source or binary. For more information,
please see
<a href="https://www.apache.org/dev/release.html";>Apache
Release FAQ</a>
</p>
@@ -51,21 +51,21 @@
</tr>
<tr class="b">
<td>
- <a name="3_2_2"></a>3.2.2</td>
+ <a name="3_2_3"></a>3.2.3</td>
<td>Release</td>
- <td>Source Distribution <a
href="[preferred]/ws/neethi/3.2.2/neethi-3.2.2-source-release.zip">zip</a>
+ <td>Source Distribution <a
href="[preferred]/ws/neethi/3.2.3/neethi-3.2.3-source-release.zip">zip</a>
- <a
href="https://downloads.apache.org/ws/neethi/3.2.2/neethi-3.2.2-source-release.zip.sha256";>SHA-256</a>
- <a
href="https://downloads.apache.org/ws/neethi/3.2.2/neethi-3.2.2-source-release.zip.asc";>PGP</a>
+ <a
href="https://downloads.apache.org/ws/neethi/3.2.3/neethi-3.2.3-source-release.zip.sha256";>SHA-256</a>
+ <a
href="https://downloads.apache.org/ws/neethi/3.2.3/neethi-3.2.3-source-release.zip.asc";>PGP</a>
<br></br>
- Binary Distribution <a
href="[preferred]/ws/neethi/3.2.2/neethi-3.2.2-bin.zip">zip</a>
- <a
href="https://downloads.apache.org/ws/neethi/3.2.2/neethi-3.2.2-bin.zip.sha256";>SHA-256</a>
- <a
href="https://downloads.apache.org/ws/neethi/3.2.2/neethi-3.2.2-bin.zip.asc";>PGP</a>
+ Binary Distribution <a
href="[preferred]/ws/neethi/3.2.3/neethi-3.2.3-bin.zip">zip</a>
+ <a
href="https://downloads.apache.org/ws/neethi/3.2.3/neethi-3.2.3-bin.zip.sha256";>SHA-256</a>
+ <a
href="https://downloads.apache.org/ws/neethi/3.2.3/neethi-3.2.3-bin.zip.asc";>PGP</a>
<br></br>
</td>
<td>April - 2026</td>
- <td>3.2.2 Release (Mirrored)</td>
+ <td>3.2.3 Release (Mirrored)</td>
</tr>
</tbody>
</table>
