Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Okay, so it took me a moment to figure out why this is even filed against fpc. FPC sources, as provided by upstream (fpcbuild-3.2.2.tar.gz), ship with this file inside the archive: "fpcbuild-3.2.2/install/jvm/bcel-6.0-SNAPSHOT.jar". Judging by the name, it contains Apache BCEL, version 6.0 - and sure enough, if you unpack the .jar, you'll see BCEL classes inside, with pom.xml declaring version 6.0. This file is installed only when FPC is built with support for compiling Pascal programs to JVM bytecode, which is currently not enabled in the Fedora / EPEL packages. As such, I'm closing this as NOTABUG.