Processing of axis_1.4-16.1_amd64.changes

2012-12-06 Thread Debian FTP Masters
axis_1.4-16.1_amd64.changes uploaded successfully to localhost along with the files: axis_1.4-16.1.dsc axis_1.4-16.1.debian.tar.gz libaxis-java_1.4-16.1_all.deb libaxis-java-doc_1.4-16.1_all.deb Greetings, Your Debian queue daemon (running on host franck.debian.org) __ This is

Processing of commons-httpclient_3.1-10.1_amd64.changes

2012-12-06 Thread Debian FTP Masters
commons-httpclient_3.1-10.1_amd64.changes uploaded successfully to localhost along with the files: commons-httpclient_3.1-10.1.dsc commons-httpclient_3.1-10.1.debian.tar.gz libcommons-httpclient-java_3.1-10.1_all.deb libcommons-httpclient-java-doc_3.1-10.1_all.deb Greetings, Your

axis_1.4-16.1_amd64.changes ACCEPTED into unstable

2012-12-06 Thread Debian FTP Masters
Accepted: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Format: 1.8 Date: Wed, 5 Dec 2012 17:28:00 +0100 Source: axis Binary: libaxis-java libaxis-java-doc Architecture: source all Version: 1.4-16.1 Distribution: unstable Urgency: low Maintainer: Debian Java Maintainers

commons-httpclient_3.1-10.1_amd64.changes ACCEPTED into unstable

2012-12-06 Thread Debian FTP Masters
Accepted: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Format: 1.8 Date: Wed, 5 Dec 2012 17:28:00 +0100 Source: commons-httpclient Binary: libcommons-httpclient-java libcommons-httpclient-java-doc Architecture: source all Version: 3.1-10.1 Distribution: unstable Urgency: low Maintainer:

Bug#692442: marked as done (CVE-2012-5783: Insecure certificate validation)

2012-12-06 Thread Debian Bug Tracking System
Your message dated Thu, 06 Dec 2012 11:50:21 + with message-id e1tgzy9-0003te...@franck.debian.org and subject line Bug#692442: fixed in commons-httpclient 3.1-10.1 has caused the Debian Bug report #692442, regarding CVE-2012-5783: Insecure certificate validation to be marked as done. This

Bug#692650: marked as done (axis: CVE-2012-5784)

2012-12-06 Thread Debian Bug Tracking System
Your message dated Thu, 06 Dec 2012 11:47:56 + with message-id e1tgzvo-0001rk...@franck.debian.org and subject line Bug#692650: fixed in axis 1.4-16.1 has caused the Debian Bug report #692650, regarding axis: CVE-2012-5784 to be marked as done. This means that you claim that the problem has

Bug#692442: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-06 Thread Alberto Fernández
Hi All, I've prepared the patch with the problem pointed by David fixed (thanks David). It also fixes a bug related to wildcard certificates. The first patch is backported from httpclient 4.0 and apache synapse. This second patch backports some fixes from httpclient 4.2 The patch differ a lot

Bug#692442: new patch for commons-httpclient CVE-2012-5783 (full patch)

2012-12-06 Thread Alberto Fernández
Description: Fixed CN extraction from DN of X500 principal and wildcard validation commons-httpclient (3.1-10.2) unstable; urgency=low * Fixed CN extraction from DN of X500 principal and wildcard validation Author: Alberto Fernández Martínez inf...@gmail.com Origin: other Bug-Debian:

Bug#692650: patch for axis CVE-2012-5784 (full patch)

2012-12-06 Thread Alberto Fernández
Description: Fixed CN extraction from DN of X500 principal and wildcard validation axis (1.4-16.2) unstable; urgency=low * Fixed CN extraction from DN of X500 principal and wildcard validation Author: Alberto Fernández Martínez inf...@gmail.com Origin: other Bug-Debian:

Bug#692442: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-06 Thread Andreas Tille
Hi Alberto, thanks for your continuous work on this. As I said in my previous mail please remember to reopen the according bugs to make sure the previous solution will not migrate to testing. I'll volunteer to sponsor your new version if you confirm that this is needed to finally fix the issue.

Processed: Reopen bugs axis: CVE-2012-5784 and commons-http-client:CVE-2012-5783

2012-12-06 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: reopen 692650 Bug #692650 {Done: Alberto Fernández Martínez inf...@gmail.com} [axis] axis: CVE-2012-5784 'reopen' may be inappropriate when a bug has been closed with a version; all fixed versions will be cleared, and you may need to re-add them.

Bug#695283: libformula-java: Use ${java:Depends}

2012-12-06 Thread Michael Terry
Package: libformula Version: 1.1.7.dfsg-2 Severity: minor Tags: patch User: ubuntu-de...@lists.ubuntu.com Usertags: origin-ubuntu raring ubuntu-patch Dear Maintainer, libformula-java currently hardcodes its dependency on libjcommon-java. But ideally it would use ${java:Depends} to be safer and

Bug#692650: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-06 Thread Alberto Fernández
Hi I've uploaded new packages to mentors. I'll be out until Monday, so feel free to review the patches and sponsor the new version if all you are confident it's all ok I think now it's fine , but if you find some other bug or improvement, I'll be happy to correct it. I'll insist next week

Processing of triplea_1.6.1.2-1_i386.changes

2012-12-06 Thread Debian FTP Masters
triplea_1.6.1.2-1_i386.changes uploaded successfully to localhost along with the files: triplea_1.6.1.2-1.dsc triplea_1.6.1.2.orig.tar.gz triplea_1.6.1.2-1.debian.tar.gz triplea_1.6.1.2-1_all.deb Greetings, Your Debian queue daemon (running on host franck.debian.org) __ This is

triplea_1.6.1.2-1_i386.changes ACCEPTED into experimental

2012-12-06 Thread Debian FTP Masters
Accepted: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Format: 1.8 Date: Wed, 05 Dec 2012 21:15:14 -0500 Source: triplea Binary: triplea Architecture: source all Version: 1.6.1.2-1 Distribution: experimental Urgency: low Maintainer: Debian Java Maintainers

Bug#692442: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-06 Thread Andreas Tille
Hi, On Thu, Dec 06, 2012 at 07:02:54PM +0100, Alberto Fernández wrote: Hi I've uploaded new packages to mentors. I'll be out until Monday, so feel free to review the patches and sponsor the new version if all you are confident it's all ok I admit I'm no Java programmer and I do not feel

Bug#692650: Patches for CVE-2012-5783 and CVE-2012-5784

2012-12-06 Thread Alberto Fernández
Hi I've reopened the two bugs. The first patch was incomplete, as pointed by David and by other bug i've found reviewing the code. The bug pointed by David can occur in some rare cases where the CA issues malformed certificates. It's rare, but there are may CA... The other bug it's about

Bug#649878:

2012-12-06 Thread Qix
This may be completely unrelated, but I was having a similar error. I looked through some of the various errors I was receiving and noticed it was trying to load projects from my Java only version of Eclipse. I changed the workspace to a new workspace for CDT and it fixed the problem. -- DJ Qix

Processed: tagging 695250

2012-12-06 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org: tags 695250 + pending Bug #695250 [tomcat6] tomcat6: CVE-2012-4534 CVE-2012-4431 CVE-2012-3546 Added tag(s) pending. thanks Stopping processing here. Please contact me if you need assistance. -- 695250:

Bug#695250: tomcat6: CVE-2012-4534 CVE-2012-4431 CVE-2012-3546

2012-12-06 Thread tony mancill
On 12/05/2012 11:43 PM, Moritz Muehlenhoff wrote: Package: tomcat6 Severity: grave Tags: security Justification: user security hole More Tomcat security issues have been disclosed: http://tomcat.apache.org/security-6.html The page contains links to the upstream fixes. BTW, is there a