jackrabbit - Debian Package Tracker

general

source: jackrabbit (main)
version: 2.20.11-1.1
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Damien Raude-Morvan [DMD]
arch: all
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.18.0+r2.14.6-1
oldstable: 2.20.3-1
stable: 2.20.11-1.1
testing: 2.20.11-1.1
unstable: 2.20.11-1.1

versioned links

2.18.0+r2.14.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.20.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.20.11-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libjackrabbit-java

action needed

A new upstream version is available: 2.23.6-beta high

A new upstream version 2.23.6-beta is available, you should consider packaging it.

Created: 2026-08-17 Last update: 2026-10-09 20:30

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2025-58782: Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
CVE-2026-92414: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
CVE-2026-92415: — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH). This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Created: 2025-09-08 Last update: 2026-10-09 15:03

3 security issues in forky high

There are 3 open security issues in forky.

3 important issues:

CVE-2025-58782: Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
CVE-2026-92414: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
CVE-2026-92415: — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH). This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

Created: 2025-09-08 Last update: 2026-10-09 15:03

3 security issues in bookworm high

There are 3 open security issues in bookworm.

2 important issues:

CVE-2026-92414: : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
CVE-2026-92415: — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH). This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

1 issue postponed or untriaged:

CVE-2025-58782: (needs triaging) Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.

Created: 2026-10-07 Last update: 2026-10-09 15:03

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2025-07-23 Last update: 2026-10-09 10:49

lintian reports 1 error high

Lintian reports 1 error about this package. You should make the package lintian clean getting rid of them.

Created: 2026-05-28 Last update: 2026-05-28 06:01

3 low-priority security issues in trixie low

There are 3 open security issues in trixie.

3 issues left for the package maintainer to handle:

CVE-2025-58782: (needs triaging) Deserialization of Untrusted Data vulnerability in Apache Jackrabbit Core and Apache Jackrabbit JCR Commons. This issue affects Apache Jackrabbit Core: from 1.0.0 through 2.22.1; Apache Jackrabbit JCR Commons: from 1.0.0 through 2.22.1. Deployments that accept JNDI URIs for JCR lookup from untrusted users allows them to inject malicious JNDI references, potentially leading to arbitrary code execution through deserialization of untrusted data. Users are recommended to upgrade to version 2.22.2. JCR lookup through JNDI has been disabled by default in 2.22.2. Users of this feature need to enable it explicitly and are adviced to review their use of JNDI URI for JCR lookup.
CVE-2026-92414: (needs triaging) : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.
CVE-2026-92415: (needs triaging) — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to arbitrary file creation or truncation. Only applications that use jackrabbit-spi2dav (directly or through jackrabbit-jcr2dav) to connect to a remote repository are affected. Jackrabbit servers are not affected. Category: unsafe reflection on wire data (HIGH). This issue affects Apache Jackrabbit: from 2.23.0 through 2.23.5, from 2.22.0 through 2.22.4, from 2.20.0 through 2.20.17. Users are recommended to upgrade to versions 2.23.6, 2.22.5, or 2.20.18 which fix the issue.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-09-08 Last update: 2026-10-09 15:03

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 2.20.11-1.1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2025-07-23 Last update: 2025-07-23 23:35

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.2).

Created: 2024-04-07 Last update: 2026-03-31 15:01

news

[rss feed]

[2025-07-25] jackrabbit 2.20.11-1.1 MIGRATED to testing (Debian testing watch)
[2025-07-23] Accepted jackrabbit 2.20.11-1.1 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2023-08-03] jackrabbit 2.20.11-1 MIGRATED to testing (Debian testing watch)
[2023-07-29] Accepted jackrabbit 2.20.11-1 (source) into unstable (Markus Koschany)
[2021-09-30] jackrabbit 2.20.3-1 MIGRATED to testing (Debian testing watch)
[2021-09-24] Accepted jackrabbit 2.20.3-1 (source) into unstable (Markus Koschany)
[2019-01-14] jackrabbit 2.18.0+r2.14.6-1 MIGRATED to testing (Debian testing watch)
[2019-01-08] Accepted jackrabbit 2.18.0+r2.14.6-1 (source) into unstable (Markus Koschany)
[2018-12-22] Accepted jackrabbit 2.18.0-1 (source) into unstable (Markus Koschany)
[2018-10-19] jackrabbit 2.14.6-1 MIGRATED to testing (Debian testing watch)
[2018-10-14] Accepted jackrabbit 2.14.6-1 (source) into unstable (Markus Koschany)
[2017-11-11] jackrabbit 2.14.4-1 MIGRATED to testing (Debian testing watch)
[2017-11-05] Accepted jackrabbit 2.14.4-1 (source) into unstable (Markus Koschany)
[2016-12-26] jackrabbit 2.12.6-1 MIGRATED to testing (Debian testing watch)
[2016-12-15] Accepted jackrabbit 2.12.6-1 (source) into unstable (Markus Koschany)
[2016-10-03] Accepted jackrabbit 2.3.6-1+deb8u2 (source all) into proposed-updates->stable-new, proposed-updates (Markus Koschany)
[2016-09-24] jackrabbit 2.12.4-1 MIGRATED to testing (Debian testing watch)
[2016-09-18] Accepted jackrabbit 2.3.6-1+deb7u2 (source all) into oldstable (Markus Koschany)
[2016-09-18] Accepted jackrabbit 2.12.4-1 (source) into unstable (Markus Koschany)
[2016-07-20] jackrabbit 2.12.2-1 MIGRATED to testing (Debian testing watch)
[2016-07-15] Accepted jackrabbit 2.12.2-1 (source all) into unstable (Markus Koschany)
[2016-04-07] jackrabbit 2.12.1-1 MIGRATED to testing (Debian testing watch)
[2016-04-01] Accepted jackrabbit 2.12.1-1 (source) into unstable (Markus Koschany)
[2015-11-25] jackrabbit 2.10.1-2 MIGRATED to testing (Britney)
[2015-11-19] Accepted jackrabbit 2.10.1-2 (source) into unstable (Markus Koschany)
[2015-07-05] Accepted jackrabbit 2.3.6-1+deb7u1 (source all) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Markus Koschany) (signed by: tony mancill)
[2015-07-04] Accepted jackrabbit 2.3.6-1+deb8u1 (source all) into proposed-updates->stable-new, proposed-updates (Markus Koschany) (signed by: tony mancill)
[2015-06-24] jackrabbit 2.10.1-1 MIGRATED to testing (Britney)
[2015-06-22] Accepted jackrabbit 2.10.1-1 (source all) into unstable (Markus Koschany) (signed by: tony mancill)
[2012-02-02] jackrabbit 2.3.6-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 2
RC: 1
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (1, 0)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.20.11-1.1