lp:~james-page/ubuntu/precise/jenkins/954960-1.424.6

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #954960: [FFe] XSS vulnerability in Jenkins

High

Fix Released

Link a bug report

Related blueprints

13. By James Page on 2012-03-15

* New upstream release, fixing XSS security vulnerability (LP: #954960):
  - d/control: Add new dependency on libowasp-java-html-sanitizer-java.
  - d/maven.rules: Add new rule to use artifacts
    from libowasp-java-html-sanitizer-java.

12. By James Page on 2012-03-12

Switch upstart configuration to use start-stop-daemon to allow
desktop systems to shutdown (LP: #952902).

11. By James Page on 2012-02-28

* New upstream bugfix release.
* Refreshed patches:
  - Dropped disable-avalon-frawework.patch - no longer required.
* Bumped Standards-Version: 3.9.3; no changes required.
* Enable use of jenkins-instance-identity and jenkins-ssh-cli-auth to
  support use of public/private keypairs when using the jenkins remote
  cli tool.
* Dropped jcaptcha-slf4j.patch; no longer required as library not used.
* Updated plugin parent pom file to specifiy default source/target for
  maven-compiler-plugin as Java 1.5.
* Ensure that jenkins group exists and that its the primary group for
  the jenkins user to help deal with transition from upstream packaging
  (Closes: #661203).

10. By James Page on 2012-02-10

* Enable Jenkins plugin components to support building plugins and
  modules (Closes: #658071):
  - d/control: Enabled libjenkins-plugin-parent-java, updated dependencies.
  - d/plugin-debian.pom.in,rules: Install pom file to act as parent POM for
    plugin development based on upstream plugin pom file.
  - d/libjenkins-plugin-parent-java.poms: Dropped - no longer required.
  - d/patches/build/plugin.patch: Dropped - no longer required.
* Switch to using libservlet2.5-java (Closes: #658805)

9. By James Page on 2012-01-31

[ Miguel Landaeta ]
* Replace dependencies on Spring Framework 2.5 libraries with 3.0 ones.
  (Closes: #655906).

[ James Page ]
* New upstream release.
  - d/control: Add new dependencies on libjenkins-remoting-java,
    libstapler-adjunct-codemirror-java and libmaven-hpi-plugin-java.
  - d/control: Dropped libjcaptcha-java; no longer needed.
* d/control: Switch to using packaged animal-sniffer.
* Refreshed patches:
  - d/patches/build/{debianize-antrun-war,animal-sniffer-annotation}.patch:
    dropped as no longer required.

8. By James Page on 2012-01-14

[ James Page ]
* http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-01-10.cb
  - Rebuild to pickup new versions of jenkins-winstone (>= 0.9.10-jenkins-31)
    and jenkins-executable-war (>= 1.25) to fix Hash DoS vulnerability in
    jenkins when running standalone.

[ Damien Raude-Morvan ]
* Add DM-Upload-Allowed flag for James Page.

7. By James Page on 2011-11-22

* New upstream release:
  - Refreshed patches.
  - d/maven.rules: Updated jenkins version to 1.409.3.
* Pickup new version of jenkins-winstone resolving XSS security
  vulnerability (LP: #889181).
* d/patches/build/apt-stapler-processing.patch: Temporary patch to fix
  build when using later versions of stapler which use standard
  Java annotation processing.

6. By James Page on 2011-10-22

* New upstream release:
  - d/control: Added new BDI's - libjtidy-java, libjenkins-htmlunit-java
  - Refreshed patches.
  - d/maven.rules: Updated jenkins version to 1.409.2.
* Updated upstart configuration to start on runlevel [2345].
* Revised patches to filter on compile/test surplus native integrations
  rather than patchout complete files.
* Re-organised patches by type.
* Fixed issue with projects with spaces in names with jenkins-monitor-job
  (LP: #880786).

5. By James Page on 2011-10-11

* Resolve conflict between winstone and libservlet2.5-java (LP: #862272):
  - debian/jenkins.upstart: Use java.net.URLClassLoader instead of
    standard WebAppClassloader to ensure the winstone classes are used.

4. By James Page on 2011-09-16

* Fix FTBFS with asm3 >= 3.3 (LP: #851659):
  - d/maven.rules: Use asm-all instead of asm to align to restructure
    of jar files.