[From nobody Tue Oct 20 10:51:07 2026
Received: (at submit) by bugs.debian.org; 20 May 2019 10:29:42 +0000
X-Spam-Checker-Version: SpamAssassin 3.4.2-bugs.debian.org_2005_01_02
 (2018-09-13) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-11.2 required=4.0 tests=BAYES_00,DIGITS_LETTERS,
 FOURLA,FVGT_m_MULTI_ODD,HAS_PACKAGE,MD5_SHA1_SUM,SPF_HELO_NONE,
 SPF_NONE,TXREP autolearn=ham autolearn_force=no
 version=3.4.2-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 23; hammy, 150; neutral, 41; spammy,
 0. spammytokens: hammytokens:0.000-+--H*UA:NeoMutt,
 0.000-+--H*u:NeoMutt, 0.000-+--UD:security-tracker.debian.org,
 0.000-+--securitytrackerdebianorg, 0.000-+--security-tracker.debian.org
Return-path: <beuc@beuc.net>
Received: from mail.beuc.net ([163.172.36.68])
 by buxtehude.debian.org with esmtp (Exim 4.89)
 (envelope-from <beuc@beuc.net>) id 1hSfY5-0002Ws-I3
 for submit@bugs.debian.org; Mon, 20 May 2019 10:29:41 +0000
Received: from localhost (localhost [127.0.0.1])
 by mail.beuc.net (Postfix) with ESMTP id 1FFBB60B1C
 for <submit@bugs.debian.org>; Mon, 20 May 2019 10:20:32 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at mail.beuc.net
Received: from mail.beuc.net ([127.0.0.1])
 by localhost (mail.beuc.net [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id xhdUbLndI1mI for <submit@bugs.debian.org>;
 Mon, 20 May 2019 10:20:31 +0000 (UTC)
Received: by mail.beuc.net (Postfix, from userid 1000)
 id 2449B60B50; Mon, 20 May 2019 10:20:31 +0000 (UTC)
Date: Mon, 20 May 2019 12:20:31 +0200
From: Sylvain Beucler <beuc@beuc.net>
To: submit@bugs.debian.org
Subject: axis: CVE-2019-0227
Message-ID: <20190520102031.frr4fror55bgpvjc@mail.beuc.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Operating-System: GNU/Linux
User-Agent: NeoMutt/20170113 (1.7.2)
X-Greylist: delayed 547 seconds by postgrey-1.36 at buxtehude;
 Mon, 20 May 2019 10:29:41 UTC
Delivered-To: submit@bugs.debian.org

Package: axis
X-Debbugs-CC: team@security.debian.org
Tags: security

Hi,

The following vulnerability was published for axis.

CVE-2019-0227[0]:
| A Server Side Request Forgery (SSRF) vulnerability affected the Apache
| Axis 1.4 distribution that was last released in 2006. Security and bug
| commits commits continue in the projects Axis 1.x Subversion
| repository, legacy users are encouraged to build from source. The
| successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not
| vulnerable to this issue.

The vulnerable 'StockQuoteService.jws' is not present in Debian binary
packages, however a SSRF mitigation was also committed [1].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-0227
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0227
[1] https://github.com/apache/axis1-java/commit/35511b872a6460129cfc0cd35baaccbd820977b5

Cheers!
Sylvain Beucler
Debian LTS Team
]