Apache Month in Review: April 2020

2020-04-30 Thread Sally Khudairi
[this announcement is available online at https://s.apache.org/Apr2020 ]

Welcome to the latest monthly overview of events from the Apache community. 
Here's a summary of what happened in April:

New this month --

 - Announcing New ASF Board of Directors https://s.apache.org/Board2020  

 - ASF Statement on the COVID-19 Coronavirus Outbreak 
https://s.apache.org/COVID-19 

 - Notice on Apache 2020 Conferences https://s.apache.org/zgm8m  

 - Success at Apache: Welcoming Communities Strengthens the Apache Way 
https://s.apache.org/tcs0m 

 - Apache Month in Review: March 2020 https://s.apache.org/Mar2020 



Important Dates --

 - Next Board Meeting: 20 May 2020. Board calendar and minutes 
http://apache.org/foundation/board/calendar.html 

 - CFP EXTENDED for ApacheCon North America: submissions due 1 June 
https://www.apachecon.com/  



Infrastructure --

Our seven-member Infrastructure team on three continents oversees our 
highly-reliable, distributed network under the leadership of VP Infrastructure 
David Nalley and Infrastructure Administrator Greg Stein. ASF Infrastructure 
supports 300+ Apache projects and their communities across ~200 individual 
machines, 1,400+ repositories, more than half a petabyte of software source 
releases, and 2-3M daily emails on 2,000+ lists. ASF Infra performs 7M+ weekly 
checks to ensure services are available around the clock. The average uptime in 
April was 99.94%.


Committer Activity --

In April, 783 Apache Committers changed 4,753,944 lines of code over 14,634 
commits. The Committers with the top 5 highest contributions, in order, were: 
Hervé Boutemy, Andrea Cosentino, Tellier Benoit, Mark Thomas, and Alex Herbert.


Project Releases and Updates --

New releases from Apache Apache Arrow (Big Data); Commons Lang and Numbers 
(Libraries); Directory (Servers); Druid (Big Data); Flagon (Incubating; 
Libraries); Flink (Big Data); Groovy (Programming Languages); HBase (Big Data); 
HTTP Server (Servers); Jackrabbit (Content); Kafka (Big Data); Libcloud (Cloud 
Computing); Lucene (Search); MyNewt (Embedded OS); NiFi (Big Data); Qpid 
(Messaging); Pulsar (Messaging); SAMOA (Big Data); Skywalking (Application 
Performance Management); Subversion (Version Control); Tika (Big Data); Tomcat 
(Servers); Traffic Control (Servers); Traffic Server (Servers); Tuweni 
(Blockchain); Wicket (Web Frameworks).

The Apache Incubator is the primary entry path for projects and codebases 
wishing to become part of the efforts at The Apache Software Foundation. 
Congratulations to Apache ShardingSphere for graduating as a Top-Level Project 
https://s.apache.org/315iv  . No new podlings have entered the Incubator over 
the past month, but we invite you to review the many projects currently in 
development in the Apache Incubator http://incubator.apache.org/  

# # #

To see our Weekly News Round-ups, visit https://blogs.apache.org/foundation/ 
and click on the calendar in the upper-right side (published every Friday) or 
hop directly to https://blogs.apache.org/foundation/category/Newsletter . For 
real-time updates, sign up for Apache-related news by sending mail to 
announce-subscr...@apache.org and follow @TheASF on Twitter. We appreciate your 
support!

= = =

NOTE: you are receiving this message because you are subscribed to the 
announce@apache.org distribution list. To unsubscribe, send email from the 
recipient account to announce-unsubscr...@apache.org with the word 
"Unsubscribe" in the subject line.


[ANN] Apache Tomcat Native 1.2.24 released

2020-04-30 Thread Mark Thomas
The Apache Tomcat team announces the immediate availability of Apache
Tomcat Native 1.2.24 stable.

The key features of this release are:
- Improvements to the build system
- Update Windows binaries to APR 1.7.0 and OpenSSL 1.1.1g

Please refer to the change log for the complete list of changes:
http://tomcat.apache.org/native-doc/miscellaneous/changelog.html

Downloads:
http://tomcat.apache.org/download-native.cgi

The Apache Tomcat Native Library provides portable API for features
not found in contemporary JDK's. It uses Apache Portable Runtime as
operating system abstraction layer and OpenSSL for SSL networking and
allows optimal performance in production environments.


[CVE-2019-0235 ] Apache OFBiz multiple CSRF vulnerabilities

2020-04-30 Thread jler...@apache.org

Severity:
Important

Vendor:
The Apache Software Foundation

Versions Affected:
OFBiz 17.12.01

Description:
Apache OFBiz is vulnerable to CSRF attacks

Mitigation:
Upgrade to 17.12.03 or manually apply the commits at OFBIZ-11470


Credit:
Initially known by the OFBiz security team (OFBIZ-10427),
also reported later by
Man Yue Mo via RT 
Shuibo Ye 
Vikash Patnaik 
Sonali Agrahari 
Girish Vasmatkar 
Dinesh Kumar Mohanty 
Jason Nordenstam 
Pradeep Jairamani 
Faiz Zaidi 

References:
https://ofbiz.apache.org/security.html



[CVE-2019-12425] Apache OFBiz Host Header Injection

2020-04-30 Thread jler...@apache.org

Severity:
Important

Vendor:
The Apache Software Foundation

Versions Affected:
OFBiz 17.12.01

Description:
Apache OFBiz is vulnerable to Host header injection by accepting arbitrary hosts

Mitigation:
Upgrade to 17.12.03 or manually apply the commit at OFBIZ-11583


Credit:
Pradeep Jairamani 

References:
https://ofbiz.apache.org/security.html



[CVE-2019-0235 ] Apache OFBiz multiple CSRF vulnerabilities

2020-04-30 Thread jler...@apache.org

Severity:
Important

Vendor:
The Apache Software Foundation

Versions Affected:
OFBiz 17.12.01

Description:
Apache OFBiz is vulnerable to CSRF attacks

Mitigation:
Upgrade to 17.12.03 or manually apply the commits at OFBIZ-11470


Credit:
Initially known by the OFBiz security team (OFBIZ-10427),
also reported later by
Man Yue Mo via RT 
Shuibo Ye 
Vikash Patnaik 
Sonali Agrahari 
Girish Vasmatkar 
Dinesh Kumar Mohanty 
Jason Nordenstam 
Pradeep Jairamani 
Faiz Zaidi 

References:
https://ofbiz.apache.org/security.html



The Apache Software Foundation Welcomes 34 New Members

2020-04-30 Thread Sally Khudairi
[this announcement is available online at https://s.apache.org/q14mx ]

The Apache Software Foundation (ASF) welcomes the following new Members who 
were elected during the annual ASF Members' Meeting on 31 March - 2 April 2020:

John Andrunas, Paul Angus, Zaheda Bhorat, Timothy Chen, Andrea Cosentino, Adina 
Crainiceanu, Griselda Cuevas, Fokko Driesprong, PJ Fanning, Julian Feinauer, 
Drew Foulks, Von Gosling, Susan Hinrich, Clay Leeds, Swapnil M Mane, Frank 
McQuillan, Gian Merlino, Andrew Musselman, François Papon, Jerry Shao, Shao 
Feng Shi, Mohammad Asif Siddiqui, Neil Smith, Casey Stella, Jincheng Sun, 
Wangda Tan, Luca Toscano, Xiaorui Wang, Geertjan Wielenga, Sheng Wu, Kete Yang, 
Awasum Yannick, Duo Zhang, and Zhe Zhang.

The ASF incorporated in 1999 with a core membership of 21 individuals who 
oversaw the progress of the Apache HTTP Server. This group grew with Committers 
—developers who contributed code, patches, documentation, and other 
contributions, and were subsequently granted access by the Membership:

 - to "commit" or "write" (contribute) directly to the code repository;

 - the right to vote on community-related decisions; and

 - the ability propose an active user for Committership.


Those Committers who demonstrate merit in the Foundation's growth, evolution, 
and progress are nominated for ASF Membership by existing Members.

This election brings the total number of ASF Members to 813 today. Individuals 
elected as ASF Members legally serve as the "shareholders" of the Foundation 
https://www.apache.org/foundation/governance/members.html 

For more information on how the ASF works, visit 
http://www.apache.org/foundation/how-it-works.html , Apache Is Open 
https://blogs.apache.org/foundation/entry/apache-is-open , and Briefing: The 
Apache Way http://apache.org/theapacheway/ 

# # #

NOTE: you are receiving this message because you are subscribed to the 
announce@apache.org distribution list. To unsubscribe, send email from the 
recipient account to announce-unsubscr...@apache.org with the word 
"Unsubscribe" in the subject line.


[ANNOUNCE] Apache OFBiz 17.12.03 release

2020-04-30 Thread Jacopo Cappellato
The Apache OFBiz community is pleased to announce the new release "Apache
OFBiz 17.12.03".

Apache OFBiz® is an open source product for the automation of enterprise
processes that includes framework components and business applications.

http://ofbiz.apache.org/

"Apache OFBiz 17.12.03" is the third release of the 17.12 series (the
release 17.12.02 was never announced because it had a build issue); for
more details of the changes introduced with this new version please refer
to http://ofbiz.apache.org/release-notes-17.12.03.html

The release file can be downloaded following the instructions in the OFBiz
download page:

http://ofbiz.apache.org/download.html

The OFBiz community.