Description of problem: Current version of plexus-archiver package in Fedora 17 contains embedded bzip2 code implementation within the included apache-commons-compress source, which makes it vulnerable against the CVE-2012-2098 flaw (and possibly others). Version-Release number of selected component (if applicable): plexus-archiver-2.1-1.fc17 How reproducible: Always Steps to Reproduce: 1) Have a look at: /root/rpmbuild/BUILD/sonatype-plexus-archiver-25364f5/src/main/java/org/codehaus/plexus/archiver/bzip2 2) Compare it with upstream patch for CVE-2012-2098: [1] https://bugzilla.redhat.com/show_bug.cgi?id=810406#c17 Actual results: Patch from [1] is applicable against (current) plexus-archiver package version in Fedora 17 too. Expected results: plexus-archiver should use system version of the apache-commons-compress package, which is available in Fedora 17 in order in case a similar flaw is found in apache-commons-compress package, it would not be needed to patch both (apache-commons-compress & plexus-archiver packages), but just to patch apache-commons-compress package would be sufficient.
Created attachment 734677 [details] Proposed patch from Mikolaj Izdebski (original issue reporter) to correct this deficiency
Fixed in plexus-archiver-2.3-1
plexus-archiver-2.3-1.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/plexus-archiver-2.3-1.fc17
Package plexus-archiver-2.3-1.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing plexus-archiver-2.3-1.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2013-5546/plexus-archiver-2.3-1.fc17 then log in and leave karma (feedback).
I believe that this bug is fixed in plexus-archiver-2.3-1, which is available in updates for Fedora 17, so I am closing this bug now. Thank you for reporting it. You are welcome to submit any further reports. The build containing the fix can be found at Koji: http://koji.fedoraproject.org/koji/buildinfo?buildID=411159