From: Paul Sandoz <Paul.Sandoz_at_Sun.COM>
Date: Wed, 05 Aug 2009 11:38:01 +0200

Hi,

The following issues have currently been patched back to 1.0.3.1
source [1]:

   https://jersey.dev.java.net/issues/show_bug.cgi?id=342
   https://jersey.dev.java.net/issues/show_bug.cgi?id=323
   https://jersey.dev.java.net/issues/show_bug.cgi?id=279
   https://jersey.dev.java.net/issues/show_bug.cgi?id=276

Paul.

[1] https://jersey.dev.java.net/svn/jersey/tags/jersey-1.0.3.1/jersey/


On Aug 3, 2009, at 4:37 PM, Paul Sandoz wrote:

> Hi,
>
> We are going to do a 1.0.3.1 release, most likely next week, that
> has the following fixes:
>
> https://jersey.dev.java.net/issues/show_bug.cgi?id=276
> l10n resource bundles are not picked up at GlassFish v3 Jersey
> bundle
>
> https://jersey.dev.java.net/issues/show_bug.cgi?id=323
> All Jersey web services that accept XML are vulnerable to XXE
> attacks
>
> Paul.