[ANN] Apache Ant 1.9.10 and 1.10.2 Released

2018-02-06 Thread Stefan Bodewig
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

The Apache Ant Team is pleased to announce the releases of Apache Ant
1.9.10 and 1.10.2.

Apache Ant is a Java library and command-line tool that helps building
software.

The Apache Ant team currently maintains two lines of development. The
1.9.x releases require Java5 at runtime and 1.10.x requires Java8 at
runtime. Both lines are based off of Ant 1.9.7 and the 1.9.x releases
are mostly bug fix releases while additional new features are developed
for 1.10.x. We recommend using 1.10.2 unless you are required to use
versions of Java prior to Java8 during the build process.

Ant 1.10.2 contains a superset of 1.9.10 - with the exception of a few
tasks and features that no longer work with Java8 anyway (like the apt
task).

Both releases are mostly bug fix releases with a few new features being
added. A new javaversion condition can be used to detect the version of
the JVM running Ant.

The log4j listener has been deprecated as log4j 1.x is no longer
actively developed and we've made sure the listener works when using the
log4j2 logging bridge. In 1.10.2 the imaging tasks have been deprecated
as JAI doesn't seem to work with Java9 anymore.

Source and binary distributions are available for download from the
Apache Ant download site:

http://ant.apache.org/bindownload.cgi
http://ant.apache.org/srcdownload.cgi

When downloading, please verify signatures using the KEYS file available
at the above location when downloading the release.

Changes in 1.10.2 include:
==

Changes that could break older environments:
- ---

 * updated the dependency of BCEL to 6.2.
   Bugzilla Report 61196

 * delete task previously would silently accept wildcard (*)
   value for the "file" attribute. That's no longer the case
   and an exception could get thrown by the underlying filesystem
   for such use. Usage like:

   

   should instead be changed to use resource collections like:

   
 
   

 * Commons Net 3.6 is binary-code, but not source compatible;
   see change list of Commons Net 3.0 for details

 * The Log4jListener is marked as deprecated as the required log4j library
   (in version 1.x) is not maintained any more.

 * Image task is marked as deprecated as the required JAI library is not
   maintained any more and internal APIs that JAI depended on are no longer
   available in Java 9.

Fixed bugs:
- ---

 * 's  child now skips s that lack a key or
   value.
   Bugzilla Report 60767

 * bootstrapping Ant on Windows failed
   Bugzilla Report 61027

 * Fixed the issue where the SCP based tasks would try to change
   the permissions on the parent directory of a transferred file,
   instead of changing it on the transferred file itself.
   Bugzilla Reports 59648 and 43271

 * Fixed the issue where the source file being copied could end
   up being corrupted if the target of the copy happened to be
   the same source file (symlinked back to itself).
   Bugzilla Report 60644

 * Fixed the issue where symlink creation with "overwrite=false",
   on existing symlink whose target was a directory, would end
   up creating a new symlink under the target directory.
   Bugzilla Report 58683

 * Improvement to the Zip task for reduced memory usage in certain
   cases. Thanks to Glen Lewis for reporting the issue and
   suggesting the fix.
   Bugzilla Report 19516

 * Fixed an issue where the content redirected from output/error
   streams of a process, could end up being truncated.
   Bugzilla Report 58833, 58451

 * // will now throw an exception
   with a more useful error message when setFile is called twice on
   the same instance.
   Bugzilla Report 62071

Other changes:
- --

 * Added forceCsvQuoteChar option to  task. When enabled the
   values always get quoted.
   Github Pull Request #32

 * Added  attributes to various script related tasks and a
   compiled attribute to scriptdef.
   Github Pull Request #30

 * Added support for jarsigner's -tsadigestalg to .
   Bugzilla Report 60665

 * added "regexp" attribute to 
   Bugzilla Report 60968

 * reduced GC pressure by replacing all usage of FileInputStream and
   FileOutputStream.

 * Task can now also use attribute setters that expect a
   java.nio.file.Path argument.
   Bugzilla Report 61042

 * added a new magic property ant.tstamp.now that can be used to
   override the current time/date used by .
   Bugzilla Report 61079

 * added Orion support to ejbjar
   Github Pull Request #33

 * SCP task, when configured to use SFTP protocol, now preserves last
   modified timestamp on files that it uploads, if the
   preserveLastModified attribute is set to true for that task
   Bugzilla Report 58589

 * zip and the related tasks can now set the modification time of all
   entries to a fixed timestamp.
   Github Pull Request #36

 * Jsch library dependency has now been upgraded to 0.1.54. Jsch is
   the library behind the sshexec and scp Ant ta

[SECURITY] CVE-2017-5645: Apache Ant 1.9.9 and 1.10.1 - Apache Log4j 1.2.13 security vulnerability

2018-02-06 Thread jhm
CVE-2017-5645: Apache Ant 1.9.9 and 1.10.1 - Apache Log4j 1.2.13 security
vulnerability

 

Severity: low

Vendor: The Apache Software Foundation

Versions Affected:

  Apache Ant 1.9.0 - 1.9.9

  Apache Ant 1.10.0 - 1.10.1

  The unsupported Apache Ant 1.8 and lower versions are also affected.

Description:

  When using Apache Ants Log4jListener there could be a security issue with
the

  underlying Apache Log4j library in version 1.x. 

  Please note that Log4j 1.x has reached its end of life and is no longer
maintained. 

  For details about migrating away from Log4j 1.x please consult with the
Apache Log4j team.

Mitigation:

  Users should not use the Log4JListener or use the log4j2-bridge.

  (Using the bridge requires Ant 1.9.10+ or Ant 1.10.2+.)

Credit: 

  This issue was discovered by Wade Schwarz of Oracle.

 

 

-Jan Matèrne

on behalf of the Apache Ant PMC