[
https://issues.apache.org/jira/browse/THRIFT-4506?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16771067#comment-16771067
]
James E. King III commented on THRIFT-4506:
-------------------------------------------
[~yoderme] could you inspect the following staged maven central repository for
0.9.3_1 - will that be sufficient?
https://repository.apache.org/content/repositories/orgapachethrift-1035/
I'm concerned the SemVer rules state that anything after major.minor.patch is
not semantically different, so I don't know if 0.9.3_1 is sufficient or if I
need to make it 0.9.4. I'd prefer not to make a 0.9.4 just for java. That
will cause some commotion with folks looking for 0.9.4 for other languages.
Here were the tricks I needed to make it happen:
# Downloaded maven 3.6.0 to /usr/local/apache-maven-3.6.0 (probably not
necessary since bionic has 3.5.2, but I did it anyway).
# Change the artifact:mvn invocation to:
{noformat}
<artifact:mvn fork="true" mavenHome="/usr/local/apache-maven-3.6.0">
<jvmarg
value="-Dmaven.multiModuleProjectDirectory=/usr/local/apache-maven-3.6.0"/>
{noformat}
# Add to ~/.m2/settings.xml
{noformat}
<settings>
<servers>
<!-- To stage a release of some part of Maven -->
<server>
<id>apache.releases.https</id>
<username> <!-- YOUR APACHE LDAP USERNAME --> </username>
<password> <!-- YOUR APACHE LDAP PASSWORD (encrypted) --> </password>
</server>
</servers>
</settings>
{noformat}
# specify GPG_TTY=$(tty) before running "ant -Drelease=true publish"
> [CVE-2018-1320] Remove assertion in Java SASL code that would be ignored in
> release builds
> ------------------------------------------------------------------------------------------
>
> Key: THRIFT-4506
> URL: https://issues.apache.org/jira/browse/THRIFT-4506
> Project: Thrift
> Issue Type: Bug
> Components: Java - Library
> Affects Versions: 0.5
> Reporter: James E. King III
> Assignee: James E. King III
> Priority: Minor
> Labels: SASL, security
> Fix For: 0.12.0
>
>
> There is an assertion in the SASL transport for Java that will only be
> processed in debug builds, at
> https://github.com/apache/thrift/blob/master/lib/java/src/org/apache/thrift/transport/TSaslTransport.java#L298.
> The preceeding while loop can be changed to guarantee this assertion in all
> builds.
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1320
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
