[JBoss JIRA] (JBDS-3570) Include eap-6.4-CVE-2015-7501 into JBDS installer
by Martin Malina (JIRA)
[ https://issues.jboss.org/browse/JBDS-3570?page=com.atlassian.jira.plugin.... ]
Martin Malina updated JBDS-3570:
--------------------------------
Affects: Release Notes
> Include eap-6.4-CVE-2015-7501 into JBDS installer
> -------------------------------------------------
>
> Key: JBDS-3570
> URL: https://issues.jboss.org/browse/JBDS-3570
> Project: Developer Studio (JBoss Developer Studio)
> Issue Type: Task
> Components: build
> Affects Versions: 9.1.0.Beta1, 10.0.0.Alpha1
> Reporter: Martin Malina
> Assignee: Nick Boldt
> Priority: Critical
> Fix For: 9.1.0.Beta1, 10.0.0.Alpha1
>
>
> During the whole thing about JBDS-3560, JBDS-3561 and JBDS-3562, Nick changed JBDS 9.1.0 to use the internal build of EAP 6.4.5 in the build process:
> 4.3.x branch:
> https://github.com/jbdevstudio/jbdevstudio-product/commit/c8aea70202616df...
> And in master:
> https://github.com/jbdevstudio/jbdevstudio-product/commit/6792edbfefcf54d...
> I understand that some of the above mentioned JIRAs are not resolved yet, but I wanted to be sure to track this - we need to make sure not to bundle this build of EAP, because it's an internal build not supposed to be public. (Yes, the original assumption was that perhaps this time there would be an exception, but it turned out not to be the case.)
> For JBDS 9.1.0.Beta1 I suggest we include the same patched EAP as discussed in JBDS-3562 . But it's kind of tricky how to make it obvious to users - I'm not sure if we want to include the CVE in the filename again.
> But in any case, we can never include EAP 6.4.5 full build.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBDS-3570) Include eap-6.4-CVE-2015-7501 into JBDS installer
by Martin Malina (JIRA)
[ https://issues.jboss.org/browse/JBDS-3570?page=com.atlassian.jira.plugin.... ]
Martin Malina updated JBDS-3570:
--------------------------------
Summary: Include eap-6.4-CVE-2015-7501 into JBDS installer (was: Remove EAP 6.4.5 from JBDS installer)
> Include eap-6.4-CVE-2015-7501 into JBDS installer
> -------------------------------------------------
>
> Key: JBDS-3570
> URL: https://issues.jboss.org/browse/JBDS-3570
> Project: Developer Studio (JBoss Developer Studio)
> Issue Type: Task
> Components: build
> Affects Versions: 9.1.0.Beta1, 10.0.0.Alpha1
> Reporter: Martin Malina
> Assignee: Nick Boldt
> Priority: Critical
> Fix For: 9.1.0.Beta1, 10.0.0.Alpha1
>
>
> During the whole thing about JBDS-3560, JBDS-3561 and JBDS-3562, Nick changed JBDS 9.1.0 to use the internal build of EAP 6.4.5 in the build process:
> 4.3.x branch:
> https://github.com/jbdevstudio/jbdevstudio-product/commit/c8aea70202616df...
> And in master:
> https://github.com/jbdevstudio/jbdevstudio-product/commit/6792edbfefcf54d...
> I understand that some of the above mentioned JIRAs are not resolved yet, but I wanted to be sure to track this - we need to make sure not to bundle this build of EAP, because it's an internal build not supposed to be public. (Yes, the original assumption was that perhaps this time there would be an exception, but it turned out not to be the case.)
> For JBDS 9.1.0.Beta1 I suggest we include the same patched EAP as discussed in JBDS-3562 . But it's kind of tricky how to make it obvious to users - I'm not sure if we want to include the CVE in the filename again.
> But in any case, we can never include EAP 6.4.5 full build.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBDS-3570) Include eap-6.4-CVE-2015-7501 into JBDS installer
by Martin Malina (JIRA)
[ https://issues.jboss.org/browse/JBDS-3570?page=com.atlassian.jira.plugin.... ]
Martin Malina commented on JBDS-3570:
-------------------------------------
[~dgolovin], OK, as you wish, I changed the summary.
> Include eap-6.4-CVE-2015-7501 into JBDS installer
> -------------------------------------------------
>
> Key: JBDS-3570
> URL: https://issues.jboss.org/browse/JBDS-3570
> Project: Developer Studio (JBoss Developer Studio)
> Issue Type: Task
> Components: build
> Affects Versions: 9.1.0.Beta1, 10.0.0.Alpha1
> Reporter: Martin Malina
> Assignee: Nick Boldt
> Priority: Critical
> Fix For: 9.1.0.Beta1, 10.0.0.Alpha1
>
>
> During the whole thing about JBDS-3560, JBDS-3561 and JBDS-3562, Nick changed JBDS 9.1.0 to use the internal build of EAP 6.4.5 in the build process:
> 4.3.x branch:
> https://github.com/jbdevstudio/jbdevstudio-product/commit/c8aea70202616df...
> And in master:
> https://github.com/jbdevstudio/jbdevstudio-product/commit/6792edbfefcf54d...
> I understand that some of the above mentioned JIRAs are not resolved yet, but I wanted to be sure to track this - we need to make sure not to bundle this build of EAP, because it's an internal build not supposed to be public. (Yes, the original assumption was that perhaps this time there would be an exception, but it turned out not to be the case.)
> For JBDS 9.1.0.Beta1 I suggest we include the same patched EAP as discussed in JBDS-3562 . But it's kind of tricky how to make it obvious to users - I'm not sure if we want to include the CVE in the filename again.
> But in any case, we can never include EAP 6.4.5 full build.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBDS-3570) Remove EAP 6.4.5 from JBDS installer
by Denis Golovin (JIRA)
[ https://issues.jboss.org/browse/JBDS-3570?page=com.atlassian.jira.plugin.... ]
Denis Golovin commented on JBDS-3570:
-------------------------------------
IMO it should be named "Include eap-6.4-CVE-2015-7501 into JBDS installer" so we can mark it as "Affects release notes" and update release notes if eap-6.4-CVE-2015-7501 is going to be released as part of JBDS 9.1/10.0.
> Remove EAP 6.4.5 from JBDS installer
> ------------------------------------
>
> Key: JBDS-3570
> URL: https://issues.jboss.org/browse/JBDS-3570
> Project: Developer Studio (JBoss Developer Studio)
> Issue Type: Task
> Components: build
> Affects Versions: 9.1.0.Beta1, 10.0.0.Alpha1
> Reporter: Martin Malina
> Assignee: Nick Boldt
> Priority: Critical
> Fix For: 9.1.0.Beta1, 10.0.0.Alpha1
>
>
> During the whole thing about JBDS-3560, JBDS-3561 and JBDS-3562, Nick changed JBDS 9.1.0 to use the internal build of EAP 6.4.5 in the build process:
> 4.3.x branch:
> https://github.com/jbdevstudio/jbdevstudio-product/commit/c8aea70202616df...
> And in master:
> https://github.com/jbdevstudio/jbdevstudio-product/commit/6792edbfefcf54d...
> I understand that some of the above mentioned JIRAs are not resolved yet, but I wanted to be sure to track this - we need to make sure not to bundle this build of EAP, because it's an internal build not supposed to be public. (Yes, the original assumption was that perhaps this time there would be an exception, but it turned out not to be the case.)
> For JBDS 9.1.0.Beta1 I suggest we include the same patched EAP as discussed in JBDS-3562 . But it's kind of tricky how to make it obvious to users - I'm not sure if we want to include the CVE in the filename again.
> But in any case, we can never include EAP 6.4.5 full build.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBDS-3562) Prepare for 9.0.1 (9.0.0 with patched EAP 6.4.0 BZ1281963 / CVE-2015-7501)
by Martin Malina (JIRA)
[ https://issues.jboss.org/browse/JBDS-3562?page=com.atlassian.jira.plugin.... ]
Martin Malina commented on JBDS-3562:
-------------------------------------
{quote}So, once again, the only way to know you're using the patched EAP is to look for the bugzilla number in the EAP install folder.{quote}
That or via EAP Admin Console when the server is running:
http://localhost:9990/console/App.html#patching
There you will see a list of applied patches. (You will need to add an admin user via $EAP_HOME/bin/add-user.sh first.)
> Prepare for 9.0.1 (9.0.0 with patched EAP 6.4.0 BZ1281963 / CVE-2015-7501)
> --------------------------------------------------------------------------
>
> Key: JBDS-3562
> URL: https://issues.jboss.org/browse/JBDS-3562
> Project: Developer Studio (JBoss Developer Studio)
> Issue Type: Bug
> Components: build
> Affects Versions: 9.0.1.GA
> Reporter: Nick Boldt
> Assignee: Nick Boldt
> Fix For: 9.0.1.GA
>
> Attachments: 900GAvs901GA_B6.p2diff.txt, JBDS900GA-respin_diffs__EAP640-BZ1281963.png, JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640.png, JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640__002.png, JBDS900GA-respin_diffs__google.gson_JBDSTPvsJBDSCentralTP.png, JBDS900GA-respin_diffs__google.gson_JBDSTPvsJBDSCentralTP_210_refs.png, JBDS900GA-respin_diffs__google.gson_JBDSTPvsJBDSCentralTP_224_refs.png, JBDS900GA-respin_diffs__o.e.jst.plugins.manifest.mf.png, JBDS900GA-respin_diffs__p2director.manifest.mf.png, JBDS900GA-respin_diffs__plugins_including_gson2.1.0vs.2.2.4.png, JBDS900GA-respin_diffs__readme.txt.png
>
>
> Tracker JIRA to house things to do to prepare for 9.0.1 / 9.1.0 branches & builds.
> Because JBDS 9.0.0 includes the compromised version of
> apache.commons.collections (JBDS-3560, JBDS-3561), we need to at some point respin it, which
> will include:
> a) updated JBT/JBDS target platforms 4.50.1.* and 4.51.1.*
> b) repin of JBDS update sites and installer jars
> To that end, I've created the following new branches:
> https://github.com/jbosstools/jbosstools-target-platforms/commits/4.50.1.x
> https://github.com/jbosstools/jbosstools-target-platforms/commits/4.51.1.x
> And I've bumped the version of the target platforms in the 4.50.x and
> 4.51.x branches to 4.50.2.Beta1-SNAPSHOT and 4.51.2.Beta1-SNAPSHOT,
> respectively.
> JBDS is now at version 9.1.0 in the 4.3.x branch and 9.0.1 in the
> 4.3.1.x branch.
> https://github.com/jbdevstudio/jbdevstudio-product/commits/jbosstools-4.3...
> (new, 9.0.1)
> https://github.com/jbdevstudio/jbdevstudio-product/commits/jbosstools-4.3.x
> (updated to 9.1.0)
> So, now we just need to ensure that the correct BUILD_ALIAS (CR1 for
> 9.0.1, Beta1 for 9.1.0) and target platforms are used.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBIDE-21179) Upgrade Forge Runtime to 3.0.0.Alpha2
by Max Rydahl Andersen (JIRA)
[ https://issues.jboss.org/browse/JBIDE-21179?page=com.atlassian.jira.plugi... ]
Max Rydahl Andersen commented on JBIDE-21179:
---------------------------------------------
sure, but JBDS 9 to 9.1 is not a major update.
And Forge team decided against having multiple version support in JBDS 9 so we are limited to what options we have.
But talk with Alexey and Koen on impacts and make sure JBDS product manager is okey with this move.
> Upgrade Forge Runtime to 3.0.0.Alpha2
> -------------------------------------
>
> Key: JBIDE-21179
> URL: https://issues.jboss.org/browse/JBIDE-21179
> Project: Tools (JBoss Tools)
> Issue Type: Component Upgrade
> Components: forge
> Affects Versions: 4.3.0.Final
> Reporter: George Gastaldi
> Assignee: George Gastaldi
> Labels: new_and_noteworthy
> Fix For: 4.3.1.Beta1, 4.4.0.Alpha1
>
>
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBDS-3562) Prepare for 9.0.1 (9.0.0 with patched EAP 6.4.0 BZ1281963 / CVE-2015-7501)
by Nick Boldt (JIRA)
[ https://issues.jboss.org/browse/JBDS-3562?page=com.atlassian.jira.plugin.... ]
Nick Boldt updated JBDS-3562:
-----------------------------
Attachment: JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640__002.png
JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640.png
Len asked a question in email:
{quote}Question for everyone - What version string will be displayed in the "about" dialog? If the version is 9.0, then the user will need some easy way to identify the embedded EAP.{quote}
As expected, there's no way in JBDS to tell if you're using the patched EAP 6.4 or the original. I launched both JBDS 9.0.0.GA_B124 (orig from October) and JBDS 9.0.0.GA_B12 (patched in Dec) against the same workspace, and here's what I see for available EAP runtimes within JBDS:
!JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640.png!
!JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640__002.png
Note too that if you look in the version file for the patched EAP6.4, it says:
{code}
$➔ cat version.txt
Red Hat JBoss Enterprise Application Platform - Version 6.4.0.GA
{code}
So, once again, the only way to know you're using the patched EAP is to look for the bugzilla number in the EAP install folder:
{code}
$➔ find . -iname "*1281963*" -o -iname "*bz*"
./modules/system/layers/base/.overlays/BZ1281963
./modules/system/layers/base/.overlays/BZ1281963/org/apache/commons/collections/main/commons-collections-3.2.1.redhat-3-bz-1281963.jar
./.installation/patches/eap-640-bz1281963
{code}
> Prepare for 9.0.1 (9.0.0 with patched EAP 6.4.0 BZ1281963 / CVE-2015-7501)
> --------------------------------------------------------------------------
>
> Key: JBDS-3562
> URL: https://issues.jboss.org/browse/JBDS-3562
> Project: Developer Studio (JBoss Developer Studio)
> Issue Type: Bug
> Components: build
> Affects Versions: 9.0.1.GA
> Reporter: Nick Boldt
> Assignee: Nick Boldt
> Fix For: 9.0.1.GA
>
> Attachments: 900GAvs901GA_B6.p2diff.txt, JBDS900GA-respin_diffs__EAP640-BZ1281963.png, JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640.png, JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640__002.png, JBDS900GA-respin_diffs__google.gson_JBDSTPvsJBDSCentralTP.png, JBDS900GA-respin_diffs__google.gson_JBDSTPvsJBDSCentralTP_210_refs.png, JBDS900GA-respin_diffs__google.gson_JBDSTPvsJBDSCentralTP_224_refs.png, JBDS900GA-respin_diffs__o.e.jst.plugins.manifest.mf.png, JBDS900GA-respin_diffs__p2director.manifest.mf.png, JBDS900GA-respin_diffs__plugins_including_gson2.1.0vs.2.2.4.png, JBDS900GA-respin_diffs__readme.txt.png
>
>
> Tracker JIRA to house things to do to prepare for 9.0.1 / 9.1.0 branches & builds.
> Because JBDS 9.0.0 includes the compromised version of
> apache.commons.collections (JBDS-3560, JBDS-3561), we need to at some point respin it, which
> will include:
> a) updated JBT/JBDS target platforms 4.50.1.* and 4.51.1.*
> b) repin of JBDS update sites and installer jars
> To that end, I've created the following new branches:
> https://github.com/jbosstools/jbosstools-target-platforms/commits/4.50.1.x
> https://github.com/jbosstools/jbosstools-target-platforms/commits/4.51.1.x
> And I've bumped the version of the target platforms in the 4.50.x and
> 4.51.x branches to 4.50.2.Beta1-SNAPSHOT and 4.51.2.Beta1-SNAPSHOT,
> respectively.
> JBDS is now at version 9.1.0 in the 4.3.x branch and 9.0.1 in the
> 4.3.1.x branch.
> https://github.com/jbdevstudio/jbdevstudio-product/commits/jbosstools-4.3...
> (new, 9.0.1)
> https://github.com/jbdevstudio/jbdevstudio-product/commits/jbosstools-4.3.x
> (updated to 9.1.0)
> So, now we just need to ensure that the correct BUILD_ALIAS (CR1 for
> 9.0.1, Beta1 for 9.1.0) and target platforms are used.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months
[JBoss JIRA] (JBDS-3562) Prepare for 9.0.1 (9.0.0 with patched EAP 6.4.0 BZ1281963 / CVE-2015-7501)
by Nick Boldt (JIRA)
[ https://issues.jboss.org/browse/JBDS-3562?page=com.atlassian.jira.plugin.... ]
Nick Boldt edited comment on JBDS-3562 at 12/7/15 9:38 AM:
-----------------------------------------------------------
Len asked a question in email:
{quote}Question for everyone - What version string will be displayed in the "about" dialog? If the version is 9.0, then the user will need some easy way to identify the embedded EAP.{quote}
As expected, there's no way in JBDS to tell if you're using the patched EAP 6.4 or the original. I launched both JBDS 9.0.0.GA_B124 (orig from October) and JBDS 9.0.0.GA_B12 (patched in Dec) against the same workspace, and here's what I see for available EAP runtimes within JBDS:
* [^JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640.png]
* [^JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640__002.png]
Note too that if you look in the version file for the patched EAP6.4, it says:
{code}
$➔ cat version.txt
Red Hat JBoss Enterprise Application Platform - Version 6.4.0.GA
{code}
So, once again, the only way to know you're using the patched EAP is to look for the bugzilla number in the EAP install folder:
{code}
$➔ find . -iname "*1281963*" -o -iname "*bz*"
./modules/system/layers/base/.overlays/BZ1281963
./modules/system/layers/base/.overlays/BZ1281963/org/apache/commons/collections/main/commons-collections-3.2.1.redhat-3-bz-1281963.jar
./.installation/patches/eap-640-bz1281963
{code}
was (Author: nickboldt):
Len asked a question in email:
{quote}Question for everyone - What version string will be displayed in the "about" dialog? If the version is 9.0, then the user will need some easy way to identify the embedded EAP.{quote}
As expected, there's no way in JBDS to tell if you're using the patched EAP 6.4 or the original. I launched both JBDS 9.0.0.GA_B124 (orig from October) and JBDS 9.0.0.GA_B12 (patched in Dec) against the same workspace, and here's what I see for available EAP runtimes within JBDS:
!JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640.png!
!JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640__002.png
Note too that if you look in the version file for the patched EAP6.4, it says:
{code}
$➔ cat version.txt
Red Hat JBoss Enterprise Application Platform - Version 6.4.0.GA
{code}
So, once again, the only way to know you're using the patched EAP is to look for the bugzilla number in the EAP install folder:
{code}
$➔ find . -iname "*1281963*" -o -iname "*bz*"
./modules/system/layers/base/.overlays/BZ1281963
./modules/system/layers/base/.overlays/BZ1281963/org/apache/commons/collections/main/commons-collections-3.2.1.redhat-3-bz-1281963.jar
./.installation/patches/eap-640-bz1281963
{code}
> Prepare for 9.0.1 (9.0.0 with patched EAP 6.4.0 BZ1281963 / CVE-2015-7501)
> --------------------------------------------------------------------------
>
> Key: JBDS-3562
> URL: https://issues.jboss.org/browse/JBDS-3562
> Project: Developer Studio (JBoss Developer Studio)
> Issue Type: Bug
> Components: build
> Affects Versions: 9.0.1.GA
> Reporter: Nick Boldt
> Assignee: Nick Boldt
> Fix For: 9.0.1.GA
>
> Attachments: 900GAvs901GA_B6.p2diff.txt, JBDS900GA-respin_diffs__EAP640-BZ1281963.png, JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640.png, JBDS900GA-respin_diffs__EAP640patched-looks-the-same-as-EAP640__002.png, JBDS900GA-respin_diffs__google.gson_JBDSTPvsJBDSCentralTP.png, JBDS900GA-respin_diffs__google.gson_JBDSTPvsJBDSCentralTP_210_refs.png, JBDS900GA-respin_diffs__google.gson_JBDSTPvsJBDSCentralTP_224_refs.png, JBDS900GA-respin_diffs__o.e.jst.plugins.manifest.mf.png, JBDS900GA-respin_diffs__p2director.manifest.mf.png, JBDS900GA-respin_diffs__plugins_including_gson2.1.0vs.2.2.4.png, JBDS900GA-respin_diffs__readme.txt.png
>
>
> Tracker JIRA to house things to do to prepare for 9.0.1 / 9.1.0 branches & builds.
> Because JBDS 9.0.0 includes the compromised version of
> apache.commons.collections (JBDS-3560, JBDS-3561), we need to at some point respin it, which
> will include:
> a) updated JBT/JBDS target platforms 4.50.1.* and 4.51.1.*
> b) repin of JBDS update sites and installer jars
> To that end, I've created the following new branches:
> https://github.com/jbosstools/jbosstools-target-platforms/commits/4.50.1.x
> https://github.com/jbosstools/jbosstools-target-platforms/commits/4.51.1.x
> And I've bumped the version of the target platforms in the 4.50.x and
> 4.51.x branches to 4.50.2.Beta1-SNAPSHOT and 4.51.2.Beta1-SNAPSHOT,
> respectively.
> JBDS is now at version 9.1.0 in the 4.3.x branch and 9.0.1 in the
> 4.3.1.x branch.
> https://github.com/jbdevstudio/jbdevstudio-product/commits/jbosstools-4.3...
> (new, 9.0.1)
> https://github.com/jbdevstudio/jbdevstudio-product/commits/jbosstools-4.3.x
> (updated to 9.1.0)
> So, now we just need to ensure that the correct BUILD_ALIAS (CR1 for
> 9.0.1, Beta1 for 9.1.0) and target platforms are used.
--
This message was sent by Atlassian JIRA
(v6.4.11#64026)
10 years, 4 months