Browse code
Fix for CVE-2017-9735 in wavefront-proxy
Change-Id: Ic8b9050d0fb3826f5336f91e3314ee6fcf3e948f
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/3946
Reviewed-by: Sharath George
Tested-by: Sharath George
DheerajSShetty authored on 2017/10/04 04:48:43Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,12 @@ |
| 0 |
+diff -durp a/pom.xml b/pom.xml |
|
| 1 |
+--- a/pom.xml 2017-07-18 14:16:40.000000000 -0700 |
|
| 2 |
+@@ -55,7 +55,7 @@ |
|
| 3 |
+ <truth.version>0.29</truth.version> |
|
| 4 |
+ |
|
| 5 |
+ <java.version>1.8</java.version> |
|
| 6 |
+- <jetty.version>9.4.5.v20170502</jetty.version> |
|
| 7 |
++ <jetty.version>9.4.7.v20170914</jetty.version> |
|
| 8 |
+ <jackson.version>2.7.4</jackson.version> |
|
| 9 |
+ <netty.version>4.1.11.Final</netty.version> |
|
| 10 |
+ <public.project.version>4.16</public.project.version> |
| ... | ... |
@@ -1,11 +1,12 @@ |
| 1 | 1 |
Summary: lightweight java application to send metrics to. |
| 2 | 2 |
Name: wavefront-proxy |
| 3 | 3 |
Version: 4.16 |
| 4 |
-Release: 2%{?dist}
|
|
| 4 |
+Release: 3%{?dist}
|
|
| 5 | 5 |
License: Apache 2.0 |
| 6 | 6 |
URL: https://github.com/wavefrontHQ/java |
| 7 | 7 |
Source0: https://github.com/wavefrontHQ/java/archive/wavefront-%{version}.tar.gz
|
| 8 | 8 |
%define sha1 wavefront=ff6ff22118e69c9df8de1427aa67659ebeb3341f |
| 9 |
+Patch0: CVE-2017-9735.patch |
|
| 9 | 10 |
Group: Development/Tools |
| 10 | 11 |
Vendor: VMware, Inc. |
| 11 | 12 |
Distribution: Photon |
| ... | ... |
@@ -26,7 +27,7 @@ It handles authentication and the transmission of your metrics to your Wavefront |
| 26 | 26 |
|
| 27 | 27 |
%prep |
| 28 | 28 |
%setup -n java-wavefront-%{version}
|
| 29 |
- |
|
| 29 |
+%patch0 -p1 |
|
| 30 | 30 |
|
| 31 | 31 |
cat << EOF >>wavefront-proxy.service |
| 32 | 32 |
[Unit] |
| ... | ... |
@@ -103,6 +104,8 @@ rm -rf %{buildroot}/*
|
| 103 | 103 |
%{_unitdir}/wavefront-proxy.service
|
| 104 | 104 |
|
| 105 | 105 |
%changelog |
| 106 |
+* Tue Oct 03 2017 Dheeraj Shetty <dheerajs@vmware.com> 4.16-3 |
|
| 107 |
+- Fix for CVE-2017-9735 |
|
| 106 | 108 |
* Mon Sep 18 2017 Alexey Makhalov <amakhalov@vmware.com> 4.16-2 |
| 107 | 109 |
- Remove shadow from requires and use explicit tools for post actions |
| 108 | 110 |
* Tue Jul 18 2017 Dheeraj Shetty <dheerajs@vmware.com> 4.16-1 |