diff --git a/xmlrpc3-CVE-2011-3600.patch b/xmlrpc3-CVE-2011-3600.patch
new file mode 100644
index 0000000..bfd2d08
--- /dev/null
+++ b/xmlrpc3-CVE-2011-3600.patch
@@ -0,0 +1,55 @@
+diff -up ./common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java.fix ./common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java
+--- ./common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java.fix 2011-10-07 18:26:38.000000000 -0400
++++ ./common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java 2011-10-07 18:26:21.000000000 -0400
+@@ -16,6 +16,20 @@ public class SAXParsers {
+ spf = SAXParserFactory.newInstance();
+ spf.setNamespaceAware(true);
+ spf.setValidating(false);
++ try {
++ spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
++ } catch (javax.xml.parsers.ParserConfigurationException e) {
++ // Ignore it
++ } catch (org.xml.sax.SAXException e) {
++ // Ignore it
++ }
++ try {
++ spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
++ } catch (javax.xml.parsers.ParserConfigurationException e) {
++ // Ignore it
++ } catch (org.xml.sax.SAXException e) {
++ // Ignore it
++ }
+ }
+
+ /** Creates a new instance of {@link XMLReader}.
+diff -up ./pom.xml.fix ./pom.xml
+--- ./pom.xml.fix 2011-10-07 18:17:04.000000000 -0400
++++ ./pom.xml 2011-10-07 18:18:52.000000000 -0400
+@@ -173,6 +173,10 @@
+ Ken Weiner
+ kweiner@gmail.com
+
++
++ Johan Hôgre
++ johan.hagre@home.se
++
+
+
+ scm:svn:scm:svn:https://svn.apache.org/repos/asf/webservices/xmlrpc/tags/XMLRPC_3_0
+diff -up ./src/changes/changes.xml.fix ./src/changes/changes.xml
+--- ./src/changes/changes.xml.fix 2011-10-07 18:22:58.000000000 -0400
++++ ./src/changes/changes.xml 2011-10-07 18:22:40.000000000 -0400
+@@ -65,6 +65,13 @@
+ due-to-email="Catalin.Hritcu@gmail.com" issue="XMLRPC-109">
+ Fixed an invalid FAQ example.
+
++
++
++ Fixed a potential security hole: The client has been able to
++ include server side resources
++ into the request by using external entities.
++
+
+
+ = 1.3
Requires: jsse
Requires: ws-jaxme
Requires: ws-commons-util
+Requires(post): jpackage-utils
+Requires(postun): jpackage-utils
BuildArch: noarch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -171,6 +174,8 @@ tar jxf %{SOURCE3}
%patch3
%endif
+%patch4
+
export MAVEN_REPO_LOCAL=$(pwd)/.m2/repository
rm -rf $MAVEN_REPO_LOCAL
mkdir -p $MAVEN_REPO_LOCAL
@@ -277,6 +282,19 @@ install -m 644 common/target/%{mainname}-common-%{version}.jar \
(cd $RPM_BUILD_ROOT%{_javadir} && for jar in *-%{version}*; do \
ln -sf ${jar} ${jar/-%{version}/}; done)
+# install maven pom files
+install -Dm 644 pom.xml $RPM_BUILD_ROOT%{_mavenpomdir}/JPP-%{name}.pom
+install -Dm 644 common/pom.xml $RPM_BUILD_ROOT%{_mavenpomdir}/JPP-%{name}-common.pom
+install -Dm 644 client/pom.xml $RPM_BUILD_ROOT%{_mavenpomdir}/JPP-%{name}-client.pom
+install -Dm 644 server/pom.xml $RPM_BUILD_ROOT%{_mavenpomdir}/JPP-%{name}-server.pom
+
+# ... and maven depmaps
+%add_to_maven_depmap org.apache.xmlrpc %{mainname} %{version} JPP %{name}
+%add_to_maven_depmap org.apache.xmlrpc %{mainname}-common %{version} JPP %{name}-common
+%add_to_maven_depmap org.apache.xmlrpc %{mainname}-client %{version} JPP %{name}-client
+%add_to_maven_depmap org.apache.xmlrpc %{mainname}-server %{version} JPP %{name}-server
+
+
# sources jars
install -m 644 client/target/%{mainname}-client-%{version}-sources.jar \
$RPM_BUILD_ROOT%{_javadir}/%{name}-client-%{version}-sources.jar
@@ -298,6 +316,12 @@ cp -pr server/target/site/apidocs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{vers
%clean
rm -rf $RPM_BUILD_ROOT
+%post common
+%update_maven_depmap
+
+%postun common
+%update_maven_depmap
+
%files javadoc
%defattr(-,root,root,-)
%doc LICENSE.txt
@@ -306,6 +330,11 @@ rm -rf $RPM_BUILD_ROOT
%files common
%defattr(-,root,root,-)
%doc LICENSE.txt
+%{_mavenpomdir}/JPP-%{name}.pom
+%{_mavenpomdir}/JPP-%{name}-common.pom
+%{_mavenpomdir}/JPP-%{name}-client.pom
+%{_mavenpomdir}/JPP-%{name}-server.pom
+%{_mavendepmapfragdir}/%{name}
%{_javadir}/%{name}-common.jar
%{_javadir}/%{name}-common-%{version}.jar
@@ -332,6 +361,13 @@ rm -rf $RPM_BUILD_ROOT
%{_javadir}/%{name}-server-%{version}-sources.jar
%changelog
+* Tue Oct 11 2011 Jeff Johnston - 3.0-6
+- Backport security fix from 3.1.3
+- Resolves RH744364, CVE-2011-3600 - XML-RPC SAX parser information disclosure
+
+* Wed Jul 21 2010 Stanislav Ochotnicky - 3.0-5
+- Install maven depmaps and pom.xml files
+
* Mon Jul 12 2010 Andrew Overholt 3.0-4.15
- Ensure license is also in -javadoc package