Resolve RH744364, CVE-2011-3600 - XML-RPC SAX parser information disclosure

xmlrpc3-CVE-2011-3600.patch

@@ -0,0 +1,55 @@
+diff -up ./common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java.fix ./common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java
+--- ./common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java.fix	2011-10-07 18:26:38.000000000 -0400
++++ ./common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java	2011-10-07 18:26:21.000000000 -0400
+@@ -16,6 +16,20 @@ public class SAXParsers {
+ 		spf = SAXParserFactory.newInstance();
+ 		spf.setNamespaceAware(true);
+ 		spf.setValidating(false);
++		try {        
++			spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
++		} catch (javax.xml.parsers.ParserConfigurationException e) {
++			// Ignore it
++		} catch (org.xml.sax.SAXException e) {
++			// Ignore it
++		}                    
++		try {        
++			spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
++		} catch (javax.xml.parsers.ParserConfigurationException e) {
++			// Ignore it
++		} catch (org.xml.sax.SAXException e) {
++			// Ignore it
++		}    
+ 	}
+ 
+ 	/** Creates a new instance of {@link XMLReader}.
+diff -up ./pom.xml.fix ./pom.xml
+--- ./pom.xml.fix	2011-10-07 18:17:04.000000000 -0400
++++ ./pom.xml	2011-10-07 18:18:52.000000000 -0400
+@@ -173,6 +173,10 @@
+             <name>Ken Weiner</name>
+             <email>kweiner@gmail.com</email>
+         </contributor>
++        <contributor>
++            <name>Johan H&#244;gre</name>
++            <email>johan.hagre@home.se</email>
++        </contributor>
+     </contributors>
+     <scm>
+         <connection>scm:svn:scm:svn:https://svn.apache.org/repos/asf/webservices/xmlrpc/tags/XMLRPC_3_0</connection>
+diff -up ./src/changes/changes.xml.fix ./src/changes/changes.xml
+--- ./src/changes/changes.xml.fix	2011-10-07 18:22:58.000000000 -0400
++++ ./src/changes/changes.xml	2011-10-07 18:22:40.000000000 -0400
+@@ -65,6 +65,13 @@
+           due-to-email="Catalin.Hritcu@gmail.com" issue="XMLRPC-109">
+         Fixed an invalid FAQ example.
+       </action>
++       </action>
++      <action dev="jochen" type="fix" due-to="Johan H&#244;gre"
++          due-to-email="johan.hagre@home.se">
++        Fixed a potential security hole: The client has been able to 
++        include server side resources
++        into the request by using external entities.
++      </action>
+     </release>
+     <release version="3.0rc1" date="27-Jul-2006">
+       <action dev="jochen" type="fix" due-to="Alan Burlison"

xmlrpc3.spec

@@ -33,7 +33,7 @@
 
 Name:       xmlrpc3
 Version:    3.0
-Release:    4.15%{?dist}
+Release:    6%{?dist}
 Summary:    Java XML-RPC implementation
 License:    ASL 2.0
 Group:      Development/Libraries
@@ -56,6 +56,7 @@ Patch2:     %{name}-common-addosgimanifest.patch
 %else
 Patch3:     %{name}-ant-osgimanifests.patch
 %endif
+Patch4:     %{name}-CVE-2011-3600.patch
 
 BuildRequires:  dos2unix
 %if %{with_maven}
@@ -89,6 +90,8 @@ Requires:       jakarta-commons-codec >= 1.3
 Requires:       jsse
 Requires:       ws-jaxme
 Requires:       ws-commons-util
+Requires(post): jpackage-utils
+Requires(postun): jpackage-utils
 
 BuildArch:    noarch
 BuildRoot:  %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -171,6 +174,8 @@ tar jxf %{SOURCE3}
 %patch3
 %endif
 
+%patch4
+
 export MAVEN_REPO_LOCAL=$(pwd)/.m2/repository
 rm -rf $MAVEN_REPO_LOCAL
 mkdir -p $MAVEN_REPO_LOCAL
@@ -277,6 +282,19 @@ install -m 644 common/target/%{mainname}-common-%{version}.jar \
 (cd $RPM_BUILD_ROOT%{_javadir} && for jar in *-%{version}*; do \
 ln -sf ${jar} ${jar/-%{version}/}; done)
 
+# install maven pom files
+install -Dm 644 pom.xml $RPM_BUILD_ROOT%{_mavenpomdir}/JPP-%{name}.pom
+install -Dm 644 common/pom.xml $RPM_BUILD_ROOT%{_mavenpomdir}/JPP-%{name}-common.pom
+install -Dm 644 client/pom.xml $RPM_BUILD_ROOT%{_mavenpomdir}/JPP-%{name}-client.pom
+install -Dm 644 server/pom.xml $RPM_BUILD_ROOT%{_mavenpomdir}/JPP-%{name}-server.pom
+
+# ... and maven depmaps
+%add_to_maven_depmap org.apache.xmlrpc %{mainname} %{version} JPP %{name}
+%add_to_maven_depmap org.apache.xmlrpc %{mainname}-common %{version} JPP %{name}-common
+%add_to_maven_depmap org.apache.xmlrpc %{mainname}-client %{version} JPP %{name}-client
+%add_to_maven_depmap org.apache.xmlrpc %{mainname}-server %{version} JPP %{name}-server
+
+
 # sources jars
 install -m 644 client/target/%{mainname}-client-%{version}-sources.jar \
   $RPM_BUILD_ROOT%{_javadir}/%{name}-client-%{version}-sources.jar
@@ -298,6 +316,12 @@ cp -pr server/target/site/apidocs/* $RPM_BUILD_ROOT%{_javadocdir}/%{name}-%{vers
 %clean
 rm -rf $RPM_BUILD_ROOT
 
+%post common
+%update_maven_depmap
+
+%postun common
+%update_maven_depmap
+
 %files javadoc
 %defattr(-,root,root,-)
 %doc LICENSE.txt
@@ -306,6 +330,11 @@ rm -rf $RPM_BUILD_ROOT
 %files common
 %defattr(-,root,root,-)
 %doc LICENSE.txt
+%{_mavenpomdir}/JPP-%{name}.pom
+%{_mavenpomdir}/JPP-%{name}-common.pom
+%{_mavenpomdir}/JPP-%{name}-client.pom
+%{_mavenpomdir}/JPP-%{name}-server.pom
+%{_mavendepmapfragdir}/%{name}
 %{_javadir}/%{name}-common.jar
 %{_javadir}/%{name}-common-%{version}.jar
 
@@ -332,6 +361,13 @@ rm -rf $RPM_BUILD_ROOT
 %{_javadir}/%{name}-server-%{version}-sources.jar
 
 %changelog
+* Tue Oct 11 2011 Jeff Johnston <jjohnstn@redhat.com> - 3.0-6
+- Backport security fix from 3.1.3
+- Resolves RH744364, CVE-2011-3600 - XML-RPC SAX parser information disclosure
+
+* Wed Jul 21 2010 Stanislav Ochotnicky <sochotnicky@redhat.com> - 3.0-5
+- Install maven depmaps and pom.xml files
+
 * Mon Jul 12 2010 Andrew Overholt <overholt@redhat.com> 3.0-4.15
 - Ensure license is also in -javadoc package