{"update": {"autokarma": true, "autotime": true, "stable_karma": 3, "stable_days": 7, "unstable_karma": -3, "require_bugs": true, "require_testcases": true, "display_name": "", "notes": "```\n* Mon Oct 04 2021 Didik Supriadi <didiksupriadi41@fedoraproject.org> - 1.4.18-2\n- Enable activation, cglib, dom4j, jdom, and jdom2\n \n* Fri Oct 01 2021 Didik Supriadi <didiksupriadi41@fedoraproject.org> - 1.4.18-1\n- Update to version 1.4.18\n```", "type": "security", "status": "stable", "request": null, "severity": "high", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": false, "critpath_groups": null, "close_bugs": true, "date_submitted": "2021-10-04 13:29:10", "date_modified": null, "date_approved": null, "date_testing": "2021-10-05 15:15:42", "date_stable": "2021-10-29 22:48:33", "alias": "FEDORA-2021-5e376c0ed9", "test_gating_status": "ignored", "from_tag": null, "date_pushed": "2021-10-29 22:48:33", "meets_testing_requirements": true, "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2021-5e376c0ed9", "title": "xstream-1.4.18-2.fc35", "version_hash": "fadc5ac42882a2d86f2b02d36577e4c7c655a629", "release": {"name": "F35", "long_name": "Fedora 35", "version": "35", "id_prefix": "FEDORA", "branch": "f35", "dist_tag": "f35", "stable_tag": "f35-updates", "testing_tag": "f35-updates-testing", "candidate_tag": "f35-updates-candidate", "pending_signing_tag": "f35-signing-pending", "pending_testing_tag": "f35-updates-testing-pending", "pending_stable_tag": "f35-updates-pending", "override_tag": "f35-override", "mail_template": "fedora_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": false, "package_manager": "dnf", "testing_repository": "updates-testing", "released_on": null, "eol": null, "critpath_mandatory_days_in_testing": 14, "mandatory_days_in_testing": 7, "critpath_min_karma": 2, "min_karma": 1, "setting_status": null}, "user": {"name": "didiksupriadi41", "email": "didiksupriadi41@gmail.com", "id": 5078, "avatar": "https://seccdn.libravatar.org/avatar/1f11e76066ba099db75ddbfa7d7d7d823bcfde993c37f87c1a83fef94207f826?s=24&d=retro", "openid": "didiksupriadi41.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by didiksupriadi41. ", "timestamp": "2021-10-04 13:29:10", "update_id": 345492, "user_id": 91, "id": 2232873, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'ignored'.", "timestamp": "2021-10-04 13:29:10", "update_id": 345492, "user_id": 91, "id": 2232874, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'waiting'.", "timestamp": "2021-10-04 13:29:10", "update_id": 345492, "user_id": 91, "id": 2232875, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'ignored'.", "timestamp": "2021-10-04 14:12:14", "update_id": 345492, "user_id": 91, "id": 2232938, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2021-10-05 15:18:15", "update_id": 345492, "user_id": 91, "id": 2234925, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for stable by bodhi. ", "timestamp": "2021-10-12 15:16:17", "update_id": 345492, "user_id": 91, "id": 2245762, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to stable.", "timestamp": "2021-10-29 23:11:37", "update_id": 345492, "user_id": 91, "id": 2264803, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "xstream-1.4.18-2.fc35", "signed": true, "release_id": 51, "type": "rpm", "epoch": 0}], "bugs": [{"bug_id": 1908833, "title": "CVE-2020-26258 xstream: Server-Side Forgery Request vulnerability can be activated when unmarshalling [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1908838, "title": "CVE-2020-26259 xstream: arbitrary file deletion on the local host when unmarshalling [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942540, "title": "CVE-2021-21341 xstream: allow a remote attacker to cause DoS only by manipulating the processed input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942547, "title": "CVE-2021-21342 xstream: SSRF via crafted input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942551, "title": "CVE-2021-21343 xstream: arbitrary file deletion on the local host via crafted input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942556, "title": "CVE-2021-21344 xstream: arbitrary code execution via crafted input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942560, "title": "CVE-2021-21345 xstream: allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942579, "title": "CVE-2021-21346 xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942631, "title": "CVE-2021-21347 xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942634, "title": "CVE-2021-21348 xstream: ReDoS vulnerability [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942636, "title": "CVE-2021-21349 xstream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942638, "title": "CVE-2021-21350 xstream: allow a remote attacker to execute arbitrary code only by manipulating the processed input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1942643, "title": "CVE-2021-21351 xstream: allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1966736, "title": "CVE-2021-29505 xstream: remote command execution attack by manipulating the processed input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997764, "title": "CVE-2021-39139 xstream: vulnerable to an arbitrary code execution attack by manipulating the processed input stream with type information [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997767, "title": "CVE-2021-39140 xstream: DoS by manipulating the processed input stream [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997770, "title": "CVE-2021-39141 xstream: vulnerable to an arbitrary code execution attack [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997773, "title": "CVE-2021-39144 xstream: vulnerable to a remote command execution attack [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997776, "title": "CVE-2021-39145 xstream: vulnerable to an arbitrary code execution attack [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997778, "title": "CVE-2021-39146 xstream: vulnerable to an arbitrary code execution attack [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997780, "title": "CVE-2021-39147 xstream: vulnerable to an arbitrary code execution attack [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997782, "title": "CVE-2021-39148 xstream: vulnerable to an arbitrary code execution attack [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997785, "title": "CVE-2021-39149 xstream: vulnerable to an arbitrary code execution attack [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997788, "title": "CVE-2021-39150 xstream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997792, "title": "CVE-2021-39151 xstream: vulnerable to an arbitrary code execution attack [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997794, "title": "CVE-2021-39152 xstream: SSRF can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997796, "title": "CVE-2021-39153 xstream: vulnerable to an arbitrary code execution attack [fedora-all]", "security": true, "parent": false, "feedback": []}, {"bug_id": 1997802, "title": "CVE-2021-39154 xstream: vulnerable to an arbitrary code execution attack [fedora-all]", "security": true, "parent": false, "feedback": []}], "updateid": "FEDORA-2021-5e376c0ed9", "karma": 0, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}