Bug#692650: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-06 Thread Alberto Fernández
Hi I've uploaded new packages to mentors. I'll be out until Monday, so feel free to review the patches and sponsor the new version if all you are confident it's all ok I think now it's fine , but if you find some other bug or improvement, I'll be happy to correct it. I'll insist next week

Bug#692650: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-06 Thread Alberto Fernández
Hi I've reopened the two bugs. The first patch was incomplete, as pointed by David and by other bug i've found reviewing the code. The bug pointed by David can occur in some rare cases where the CA issues malformed certificates. It's rare, but there are may CA... The other bug it's about

Bug#692650: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-05 Thread Andreas Tille
Hi, seems the package is ready for an upload. Any reason why this is not done? I could sponsor an upload or NMU if this would help. Kind regards Andreas. -- http://fam-tille.de __ This is the maintainer address of Debian's Java team

Bug#692650: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-05 Thread Alberto Fernández
Hi, I've uploaded the two packages to mentors.debian.net. We must solve the two bugs at the same time because axis uses commons-httpclient. Upstream seems End-of-life and rejected the patches. El mié, 05-12-2012 a las 16:43 +0100, Andreas Tille escribió: Hi, seems the package is ready for

Bug#692650: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-05 Thread David Jorm
Hi All The upstream patch for CVE-2012-5783 referred to in Red Hat bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=873317#c3 Is the 4.x patch. As you've noted, there is no 3.x patch available and upstream won't provide one because it is EOL. I think Alberto's patch looks sane (from a

Bug#692650: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-05 Thread Andreas Tille
Hi, thanks for the additional information. Please note that I uploaded the NMUed packages yesterday. In case the just one small issue mentioned by David below is serious above please reopen the bug report to prevent migration to testing (I also filed unblock request bugs). Kind regards