Here are the recent changes to the packaging guidelines.
-----
Following releng approval, the restrictions on the use of rich/Boolean
dependencies have been lifted.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Rich.2FBoolean_dependencies
* https://pagure.io/packaging-committee/issue/559
-----
Packaging guidelines for Rust have been added.
* https://fedoraproject.org/wiki/Packaging:Rust
* https://pagure.io/packaging-committee/issue/705
-----
A new section was added to the packaging guidelines regarding shebang
lines. It forbids the use of 'env' and codifies the longstanding rpmlint
rule that non-executable files should not have shebang lines.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Shebang_lines
* https://pagure.io/packaging-committee/issue/700
-----
Appstream metadata guidelines were updated to reflect the new location
into which appdata files should be placed.
* https://fedoraproject.org/wiki/Packaging:AppData
* https://pagure.io/packaging-committee/issue/704
-----
The python guidelines were modified to forbid the use of /usr/bin/python
in shebang lines or as a dependency of a package.
* https://fedoraproject.org/wiki/Packaging:Python#Multiple_Python_Runtimes
* https://pagure.io/packaging-committee/issue/698
-----
The SourceURL guideliens were altered to Use a simplified form for
github URLs.
* https://fedoraproject.org/wiki/Packaging:SourceURL#Git_Hosting_Services
* https://pagure.io/packaging-committee/issue/697
-----
The section on bundled libraries was expanded with more explicit
instructions on constructing the Provides: line which indicates the
bundling.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Bundling_and_Duplication_of_system_libraries
* https://pagure.io/packaging-committee/issue/696
-----
The section on statically linking executables has been completely
revamped to remove the need for committee intervention and to make it
more obvious that there is no prohibition on statically linking to build
artifacts within a single package.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Statically_Linking_Executables
* https://pagure.io/packaging-committee/issue/692
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Friday, October 27, 2017
[CentOS-announce] CESA-2017:3075 Important CentOS 7 wget Security Update
CentOS Errata and Security Advisory 2017:3075 Important
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3075
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
d74e0e13c9f03a464eb508b06ff96dd93a58297e0515f1a29015fec5334f1b80 wget-1.14-15.el7_4.1.x86_64.rpm
Source:
0dec11e33a32973c79bcd6a690907a2f8e99507d1ff3f38be7f5f34996f5fe87 wget-1.14-15.el7_4.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3075
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
d74e0e13c9f03a464eb508b06ff96dd93a58297e0515f1a29015fec5334f1b80 wget-1.14-15.el7_4.1.x86_64.rpm
Source:
0dec11e33a32973c79bcd6a690907a2f8e99507d1ff3f38be7f5f34996f5fe87 wget-1.14-15.el7_4.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Autumn Elections 2017: Mindshare elections
Hi everybody,
as approved by Fedora Council [1] we are replacing the FAmSCo
elections with elections to a brand new body "Mindshare". You can fine
more information about the Mindshare on its wiki page [2]. For this
election cycle we have opened 2 seats into this body.
At the moment we are collecting questions for candidates in election's
Questionnaire [3]. Please have a look at it and contribute with your
questions you would like to see answered by candidates to these seats.
The Questionnaire [3] is open for new questions till November 6th.
[1] https://pagure.io/Fedora-Council/tickets/issue/142
[2] https://fedoraproject.org/wiki/Mindshare
[3] https://fedoraproject.org/wiki/Elections/Questionnaire
Thanks for your support and Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
as approved by Fedora Council [1] we are replacing the FAmSCo
elections with elections to a brand new body "Mindshare". You can fine
more information about the Mindshare on its wiki page [2]. For this
election cycle we have opened 2 seats into this body.
At the moment we are collecting questions for candidates in election's
Questionnaire [3]. Please have a look at it and contribute with your
questions you would like to see answered by candidates to these seats.
The Questionnaire [3] is open for new questions till November 6th.
[1] https://pagure.io/Fedora-Council/tickets/issue/142
[2] https://fedoraproject.org/wiki/Mindshare
[3] https://fedoraproject.org/wiki/Elections/Questionnaire
Thanks for your support and Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Thursday, October 26, 2017
Fedora 27 Final status is NO-GO
Release status of the Fedora 27 Final is NO-GO.
The next Go/No-Go meeting is planned on Thursday, November 2nd. The GA
date for the F27 Final release moves from Target date to Rain date,
which is 2017-Nov-07.
For more details please check the Go/No-Go meeting minutes[1].
[1] https://meetbot.fedoraproject.org/fedora-meeting-1/2017-10-26/f27-final-and-server-beta-go-no-go-meeting.2017-10-26-17.00.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
The next Go/No-Go meeting is planned on Thursday, November 2nd. The GA
date for the F27 Final release moves from Target date to Rain date,
which is 2017-Nov-07.
For more details please check the Go/No-Go meeting minutes[1].
[1] https://meetbot.fedoraproject.org/fedora-meeting-1/2017-10-26/f27-final-and-server-beta-go-no-go-meeting.2017-10-26-17.00.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora 27 Server Beta status (3rd round) is NO-GO
Release status of the Fedora 27 Server Beta is NO-GO.
The next Go/No-Go meeting is planned on Thursday, November 2nd
together with second round of F27 Final Go/No-Go meeting. The F27
Server Beta release slips for one week. The slip also affects the F27
Server GA, it moves to 2017-Dec-19 having Go/No-Go meeting on
2017-Dec-14.
For more information please check the F27 Server Beta Go/No-Go meeting
minutes [1].
[1] https://meetbot.fedoraproject.org/fedora-meeting-1/2017-10-26/f27-final-and-server-beta-go-no-go-meeting.2017-10-26-17.00.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
The next Go/No-Go meeting is planned on Thursday, November 2nd
together with second round of F27 Final Go/No-Go meeting. The F27
Server Beta release slips for one week. The slip also affects the F27
Server GA, it moves to 2017-Dec-19 having Go/No-Go meeting on
2017-Dec-14.
For more information please check the F27 Server Beta Go/No-Go meeting
minutes [1].
[1] https://meetbot.fedoraproject.org/fedora-meeting-1/2017-10-26/f27-final-and-server-beta-go-no-go-meeting.2017-10-26-17.00.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[USN-3466-1] systemd vulnerability
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jHnAAoJEGVp2FWnRL6TsoMQAI5AOY46M9CqJAmsvxcUswEm
9reA6xv4JQdTB/HnyG7m3Ugbox1+/kfXItQVVNcdjPt9XIMUmNPpMuIw7k62q0wX
9aO+J4OvR+uWqjuWXddvhN/j2cpI8xiiV40GPoVUUG6YMczz94TobTm02EylYMNw
fP/CoAXET5y1bmGSKMljzo0lzn0lSs70UoLgy9KaUXcBYZb9EvyNW9/SRq9Bf+hn
uC2T4TsBhFlb+IFaDPdcKMuXy1bzsL6Idx1i4NlQVSQ/4mc2z731T6LAvwnAxB8I
zgeUToWMY3rWQ93NroqjhLWazAR0H7ulpnQNeM/bHYykKE1zG4mlcZvzWctV86Bi
GZBOmWbaRd0/dzlUdaaem99HkdZOEl0hJcKu7k8f7pxHvElEIYzUOINV5t3jmGnJ
GEg9kVb73sNWqCp8VnrHebOkC9Q7Z45akMy9MwYQoe6f3aNGDjdJqyyT6wxhgOd8
U6s8E6n4WuZ9EtVb1Dey0hIHwcHv7g9EgcpCSmqwewVr1rZmohIIoUz5zU7UV0CA
uZbFin7D2xup7rMwd2tVFqy/k5E6cc60+KtvwSMa4mWNux3A4toGjH0P6cvZC19E
dBTp2Q+IK4wn0LCfC/M3NIcFsOSBZIceWUNdP/uUkqbuurXuYhxPRuhetoEFDuWq
tI83H9ovdjagsRfDde5y
=cLR9
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3466-1
October 26, 2017
systemd vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
Summary:
systemd could be made to temporarily stop responding if it received
specially crafted network traffic.
Software Description:
- systemd: system and service manager
Details:
Karim Hossen & Thomas Imbert discovered that systemd-resolved incorrectly
handled certain DNS responses. A remote attacker could possibly use this
issue to cause systemd to temporarily stop responding, resulting in a
denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
systemd 234-2ubuntu12.1
Ubuntu 17.04:
systemd 232-21ubuntu7.1
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3466-1
CVE-2017-15908
Package Information:
https://launchpad.net/ubuntu/+source/systemd/234-2ubuntu12.1
https://launchpad.net/ubuntu/+source/systemd/232-21ubuntu7.1
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jHnAAoJEGVp2FWnRL6TsoMQAI5AOY46M9CqJAmsvxcUswEm
9reA6xv4JQdTB/HnyG7m3Ugbox1+/kfXItQVVNcdjPt9XIMUmNPpMuIw7k62q0wX
9aO+J4OvR+uWqjuWXddvhN/j2cpI8xiiV40GPoVUUG6YMczz94TobTm02EylYMNw
fP/CoAXET5y1bmGSKMljzo0lzn0lSs70UoLgy9KaUXcBYZb9EvyNW9/SRq9Bf+hn
uC2T4TsBhFlb+IFaDPdcKMuXy1bzsL6Idx1i4NlQVSQ/4mc2z731T6LAvwnAxB8I
zgeUToWMY3rWQ93NroqjhLWazAR0H7ulpnQNeM/bHYykKE1zG4mlcZvzWctV86Bi
GZBOmWbaRd0/dzlUdaaem99HkdZOEl0hJcKu7k8f7pxHvElEIYzUOINV5t3jmGnJ
GEg9kVb73sNWqCp8VnrHebOkC9Q7Z45akMy9MwYQoe6f3aNGDjdJqyyT6wxhgOd8
U6s8E6n4WuZ9EtVb1Dey0hIHwcHv7g9EgcpCSmqwewVr1rZmohIIoUz5zU7UV0CA
uZbFin7D2xup7rMwd2tVFqy/k5E6cc60+KtvwSMa4mWNux3A4toGjH0P6cvZC19E
dBTp2Q+IK4wn0LCfC/M3NIcFsOSBZIceWUNdP/uUkqbuurXuYhxPRuhetoEFDuWq
tI83H9ovdjagsRfDde5y
=cLR9
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3466-1
October 26, 2017
systemd vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
Summary:
systemd could be made to temporarily stop responding if it received
specially crafted network traffic.
Software Description:
- systemd: system and service manager
Details:
Karim Hossen & Thomas Imbert discovered that systemd-resolved incorrectly
handled certain DNS responses. A remote attacker could possibly use this
issue to cause systemd to temporarily stop responding, resulting in a
denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
systemd 234-2ubuntu12.1
Ubuntu 17.04:
systemd 232-21ubuntu7.1
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3466-1
CVE-2017-15908
Package Information:
https://launchpad.net/ubuntu/+source/systemd/234-2ubuntu12.1
https://launchpad.net/ubuntu/+source/systemd/232-21ubuntu7.1
[USN-3465-1] Irssi vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jHMAAoJEGVp2FWnRL6T+hQQAI5x4RYRZvF/e+3w1H6MA2lz
jRUnVPWq8fL1NcBrD7NGt8ECgrVGhXrzm42I7zaSDRApu5OGS4DnfVoNdbWvG5eQ
NcKUvdFJyguQKCEbEzHUUqnD7fodBYicuK0RvnOgAJFlMWHy7jl77fNZnWSbZXkM
xqRw/mgytg2yGR6GZUKRYfLdmVfR6D+5t6HZl1sAO/eQxIXC6SCklIWh3HrCPl5G
zqHQm4kq00DNMimPi6WrMEavXOpXG8lfyt/cd1fo5+f7QBFQ4tSnS/bcwNAJa8UV
RWtzd5Sp8CuBuvhMMbVE+YuXAC8YECkekn135XDqofYMUxnZpTu3HSNYj1TJtcWd
OA6Kw/rj6tqnm5oFHuao+VXvexyJN/K+1oPFI8Lz3etUlSa9/VdP75vL6xGUD+rR
m8bOJ6pkgAL1RHlCfJ6PMNCSX+U0E0Q349yxpESPM7yVszsfFLxlqolFP8LR2LyH
izlgl2Q6KqRfovn0CYXaDn1fuGD7TAHgTPXg1V9Xaciqr74lX7MXx7+Q94Zv4zd1
WqJw2TCxvFiWC1WKldgunlqdg5me7Iqe1Ye+sW6BS4nE1tSpZEHJSXINDaRwGw+e
Ql7cZGca533Gngr0l+GXBkLsal1B7yiGH3OwwtMJmN0JsN78RbGh4Ry/8R4Ew5LM
ihncHR2OjtC7poRTDlmz
=Dxmd
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3465-1
October 26, 2017
irssi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Irssi.
Software Description:
- irssi: terminal based IRC client
Details:
Brian Carpenter discovered that Irssi incorrectly handled messages with
invalid time stamps. A malicious IRC server could use this issue to cause
Irssi to crash, resulting in a denial of service. (CVE-2017-10965)
Brian Carpenter discovered that Irssi incorrectly handled the internal nick
list. A malicious IRC server could use this issue to cause Irssi to crash,
resulting in a denial of service. (CVE-2017-10966)
Joseph Bisch discovered that Irssi incorrectly removed destroyed channels
from the query list. A malicious IRC server could use this issue to cause
Irssi to crash, resulting in a denial of service. (CVE-2017-15227)
Hanno Böck discovered that Irssi incorrectly handled themes. If a user were
tricked into using a malicious theme, a attacker could use this issue to
cause Irssi to crash, resulting in a denial of service. (CVE-2017-15228)
Joseph Bisch discovered that Irssi incorrectly handled certain DCC CTCP
messages. A malicious IRC server could use this issue to cause Irssi to
crash, resulting in a denial of service. (CVE-2017-15721)
Joseph Bisch discovered that Irssi incorrectly handled certain channel IDs.
A malicious IRC server could use this issue to cause Irssi to crash,
resulting in a denial of service. (CVE-2017-15722)
Joseph Bisch discovered that Irssi incorrectly handled certain long nicks
or targets. A malicious IRC server could use this issue to cause Irssi to
crash, resulting in a denial of service. (CVE-2017-15723)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
irssi 1.0.4-1ubuntu2.1
Ubuntu 17.04:
irssi 0.8.20-2ubuntu2.2
Ubuntu 16.04 LTS:
irssi 0.8.19-1ubuntu1.5
Ubuntu 14.04 LTS:
irssi 0.8.15-5ubuntu3.3
After a standard system update you need to restart Irssi to make all the
necessary changes.
References:
https://www.ubuntu.com/usn/usn-3465-1
CVE-2017-10965, CVE-2017-10966, CVE-2017-15227, CVE-2017-15228,
CVE-2017-15721, CVE-2017-15722, CVE-2017-15723
Package Information:
https://launchpad.net/ubuntu/+source/irssi/1.0.4-1ubuntu2.1
https://launchpad.net/ubuntu/+source/irssi/0.8.20-2ubuntu2.2
https://launchpad.net/ubuntu/+source/irssi/0.8.19-1ubuntu1.5
https://launchpad.net/ubuntu/+source/irssi/0.8.15-5ubuntu3.3
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jHMAAoJEGVp2FWnRL6T+hQQAI5x4RYRZvF/e+3w1H6MA2lz
jRUnVPWq8fL1NcBrD7NGt8ECgrVGhXrzm42I7zaSDRApu5OGS4DnfVoNdbWvG5eQ
NcKUvdFJyguQKCEbEzHUUqnD7fodBYicuK0RvnOgAJFlMWHy7jl77fNZnWSbZXkM
xqRw/mgytg2yGR6GZUKRYfLdmVfR6D+5t6HZl1sAO/eQxIXC6SCklIWh3HrCPl5G
zqHQm4kq00DNMimPi6WrMEavXOpXG8lfyt/cd1fo5+f7QBFQ4tSnS/bcwNAJa8UV
RWtzd5Sp8CuBuvhMMbVE+YuXAC8YECkekn135XDqofYMUxnZpTu3HSNYj1TJtcWd
OA6Kw/rj6tqnm5oFHuao+VXvexyJN/K+1oPFI8Lz3etUlSa9/VdP75vL6xGUD+rR
m8bOJ6pkgAL1RHlCfJ6PMNCSX+U0E0Q349yxpESPM7yVszsfFLxlqolFP8LR2LyH
izlgl2Q6KqRfovn0CYXaDn1fuGD7TAHgTPXg1V9Xaciqr74lX7MXx7+Q94Zv4zd1
WqJw2TCxvFiWC1WKldgunlqdg5me7Iqe1Ye+sW6BS4nE1tSpZEHJSXINDaRwGw+e
Ql7cZGca533Gngr0l+GXBkLsal1B7yiGH3OwwtMJmN0JsN78RbGh4Ry/8R4Ew5LM
ihncHR2OjtC7poRTDlmz
=Dxmd
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3465-1
October 26, 2017
irssi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Irssi.
Software Description:
- irssi: terminal based IRC client
Details:
Brian Carpenter discovered that Irssi incorrectly handled messages with
invalid time stamps. A malicious IRC server could use this issue to cause
Irssi to crash, resulting in a denial of service. (CVE-2017-10965)
Brian Carpenter discovered that Irssi incorrectly handled the internal nick
list. A malicious IRC server could use this issue to cause Irssi to crash,
resulting in a denial of service. (CVE-2017-10966)
Joseph Bisch discovered that Irssi incorrectly removed destroyed channels
from the query list. A malicious IRC server could use this issue to cause
Irssi to crash, resulting in a denial of service. (CVE-2017-15227)
Hanno Böck discovered that Irssi incorrectly handled themes. If a user were
tricked into using a malicious theme, a attacker could use this issue to
cause Irssi to crash, resulting in a denial of service. (CVE-2017-15228)
Joseph Bisch discovered that Irssi incorrectly handled certain DCC CTCP
messages. A malicious IRC server could use this issue to cause Irssi to
crash, resulting in a denial of service. (CVE-2017-15721)
Joseph Bisch discovered that Irssi incorrectly handled certain channel IDs.
A malicious IRC server could use this issue to cause Irssi to crash,
resulting in a denial of service. (CVE-2017-15722)
Joseph Bisch discovered that Irssi incorrectly handled certain long nicks
or targets. A malicious IRC server could use this issue to cause Irssi to
crash, resulting in a denial of service. (CVE-2017-15723)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
irssi 1.0.4-1ubuntu2.1
Ubuntu 17.04:
irssi 0.8.20-2ubuntu2.2
Ubuntu 16.04 LTS:
irssi 0.8.19-1ubuntu1.5
Ubuntu 14.04 LTS:
irssi 0.8.15-5ubuntu3.3
After a standard system update you need to restart Irssi to make all the
necessary changes.
References:
https://www.ubuntu.com/usn/usn-3465-1
CVE-2017-10965, CVE-2017-10966, CVE-2017-15227, CVE-2017-15228,
CVE-2017-15721, CVE-2017-15722, CVE-2017-15723
Package Information:
https://launchpad.net/ubuntu/+source/irssi/1.0.4-1ubuntu2.1
https://launchpad.net/ubuntu/+source/irssi/0.8.20-2ubuntu2.2
https://launchpad.net/ubuntu/+source/irssi/0.8.19-1ubuntu1.5
https://launchpad.net/ubuntu/+source/irssi/0.8.15-5ubuntu3.3
[USN-3464-1] Wget vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jG2AAoJEGVp2FWnRL6T3bQQALy+RfKyapjfJw4rqPpPa2OS
Unq5rSYDcTQDisGIeZ9//yqUtssVvGsEV3i0LZQmAi+SL+vawfxhQRjuRWtp9Wwc
UZ8zDrJbFVtblB9NiZQ1byn3RPINM8FWT0z7awcp4lPfvNlxx4InbeK4Xwakn/WS
dWngtZ2v0hGBK3GAqb5HSifPi2M8ioWi6+ANruSzMl4qBEF/dZ7qpkLiu3JC9vqm
H9rHef9cG7igkFB7WLOkVLeTGSMR38O4APuCvH8LEeif4RgxTKcotPo4GkNROE24
nD3XM73b8mr8yz140VRHZf1aQ2EsE6NNIlC/pRIWMqE77OUKIirZ7M1evaEWdRNe
ma2ZGZ6wp4u2july+Ci2pcMePh+pu4U634vw1ExQglZnespJA9J9V0igBOJXPKRI
dMDFdaVV6g+lnKmXO17AnWJGyf7piLQWUFsYBQ5rH5RL7/Vt5S1t8gOhdEcIWZED
S6Ve3EFWBR1fy/9Z2yZju4iYOWMAczxqDdAQwkyj1m/F5qGxh7kYFa9M/FPTpGPw
NS7VOq5xgHlccMst/13sDlGZQPozTXmTHfpgNvry8/KvZyyhbvD2O5f7zIVwcFfU
BOpfvzVXacp1GP7xGQtgWqAA1yi0RiXFS1B5Ny+3QxW/vt7NocAqZvw+/Q4IdayP
odwwsB50WMZMs41OOUFg
=PnJD
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3464-1
October 26, 2017
wget vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Wget.
Software Description:
- wget: retrieves files from the web
Details:
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget
incorrectly handled certain HTTP responses. A remote attacker could use
this issue to cause Wget to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)
Dawid Golunski discovered that Wget incorrectly handled recursive or
mirroring mode. A remote attacker could possibly use this issue to bypass
intended access list restrictions. (CVE-2016-7098)
Orange Tsai discovered that Wget incorrectly handled CRLF sequences in
HTTP headers. A remote attacker could possibly use this issue to inject
arbitrary HTTP headers. (CVE-2017-6508)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
wget 1.19.1-3ubuntu1.1
Ubuntu 17.04:
wget 1.18-2ubuntu1.1
Ubuntu 16.04 LTS:
wget 1.17.1-1ubuntu1.3
Ubuntu 14.04 LTS:
wget 1.15-1ubuntu1.14.04.3
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3464-1
CVE-2016-7098, CVE-2017-13089, CVE-2017-13090, CVE-2017-6508
Package Information:
https://launchpad.net/ubuntu/+source/wget/1.19.1-3ubuntu1.1
https://launchpad.net/ubuntu/+source/wget/1.18-2ubuntu1.1
https://launchpad.net/ubuntu/+source/wget/1.17.1-1ubuntu1.3
https://launchpad.net/ubuntu/+source/wget/1.15-1ubuntu1.14.04.3
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jG2AAoJEGVp2FWnRL6T3bQQALy+RfKyapjfJw4rqPpPa2OS
Unq5rSYDcTQDisGIeZ9//yqUtssVvGsEV3i0LZQmAi+SL+vawfxhQRjuRWtp9Wwc
UZ8zDrJbFVtblB9NiZQ1byn3RPINM8FWT0z7awcp4lPfvNlxx4InbeK4Xwakn/WS
dWngtZ2v0hGBK3GAqb5HSifPi2M8ioWi6+ANruSzMl4qBEF/dZ7qpkLiu3JC9vqm
H9rHef9cG7igkFB7WLOkVLeTGSMR38O4APuCvH8LEeif4RgxTKcotPo4GkNROE24
nD3XM73b8mr8yz140VRHZf1aQ2EsE6NNIlC/pRIWMqE77OUKIirZ7M1evaEWdRNe
ma2ZGZ6wp4u2july+Ci2pcMePh+pu4U634vw1ExQglZnespJA9J9V0igBOJXPKRI
dMDFdaVV6g+lnKmXO17AnWJGyf7piLQWUFsYBQ5rH5RL7/Vt5S1t8gOhdEcIWZED
S6Ve3EFWBR1fy/9Z2yZju4iYOWMAczxqDdAQwkyj1m/F5qGxh7kYFa9M/FPTpGPw
NS7VOq5xgHlccMst/13sDlGZQPozTXmTHfpgNvry8/KvZyyhbvD2O5f7zIVwcFfU
BOpfvzVXacp1GP7xGQtgWqAA1yi0RiXFS1B5Ny+3QxW/vt7NocAqZvw+/Q4IdayP
odwwsB50WMZMs41OOUFg
=PnJD
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3464-1
October 26, 2017
wget vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Wget.
Software Description:
- wget: retrieves files from the web
Details:
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget
incorrectly handled certain HTTP responses. A remote attacker could use
this issue to cause Wget to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)
Dawid Golunski discovered that Wget incorrectly handled recursive or
mirroring mode. A remote attacker could possibly use this issue to bypass
intended access list restrictions. (CVE-2016-7098)
Orange Tsai discovered that Wget incorrectly handled CRLF sequences in
HTTP headers. A remote attacker could possibly use this issue to inject
arbitrary HTTP headers. (CVE-2017-6508)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
wget 1.19.1-3ubuntu1.1
Ubuntu 17.04:
wget 1.18-2ubuntu1.1
Ubuntu 16.04 LTS:
wget 1.17.1-1ubuntu1.3
Ubuntu 14.04 LTS:
wget 1.15-1ubuntu1.14.04.3
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3464-1
CVE-2016-7098, CVE-2017-13089, CVE-2017-13090, CVE-2017-6508
Package Information:
https://launchpad.net/ubuntu/+source/wget/1.19.1-3ubuntu1.1
https://launchpad.net/ubuntu/+source/wget/1.18-2ubuntu1.1
https://launchpad.net/ubuntu/+source/wget/1.17.1-1ubuntu1.3
https://launchpad.net/ubuntu/+source/wget/1.15-1ubuntu1.14.04.3
F28 System Wide Change: NSS Default File Format SQL
= System Wide Change: NSS Default File Format SQL =
https://fedoraproject.org/wiki/Changes/NSSDefaultFileFormatSql
Change owner(s):
* Kai Engert <kaie@redhat.com>
Change the NSS library default to use the sqlite based data storage,
when applications don't specify their preferred storage file format.
== Detailed Description ==
Applications that use the NSS library often use a database for storage
of keys, certificates and trust. NSS supports two different file
formats, one called DBM (based on berkeley DB files) and another one
called SQL (based on sqlite DB files).
Today's default file format used by NSS, used when applications omit
the type parameter, is the older DBM file format, which forbids
parallel access to the storage. The suggestion is to change the
default file format to SQL, which allows parallel access to the
storage.
Applications, or users using the NSS command line utilities, often
provide the database storage location using a simple directory path
parameter. Some might not be aware, or forget, that the parameter can
be prefixed with a type modifier, either "dbm:" or "sql:".
As a result, when not providing this parameter, the file format used
will be the fragile DBM file format. This is particuarly problematic,
if a user attempts to modify the NSS storage using command line tools,
while another process, such as a daemon, is running concurrently,
which also accesses the same database in the DBM file format. This
often results in corrupted database storage, which cannot be
recovered.
By changing the default, all applications that currently use the DBM
file format, will automatically be migrated to the SQL file format.
NSS has the ability to discover if a storage location (a directory)
contains the DBM file format. If configured to use the modern SQL
format, NSS will automatically perform a one-time conversion from the
DBM to the SQL format.
The same applies to the NSS command line utilities. If the NSS library
default is changed to SQL, the NSS tools will also trigger the
one-time conversion, or access the already converted files.
== Scope ==
* Proposal owners:
A small downstream patch needs to be applied to the NSS library
package, which changes the library default.
* Other developers:
It's up to developers of NSS applications, if they accept the new
default and an automatic conversion, or if they prefer to continue to
use the classic DBM storage format. Although not recommended,
developers can easily do so, by adding a "dbm:" prefix to the storage
parameter they provide to NSS at NSS library initialization time.
* Release engineering: [1]
No help should be necessary. No mass rebuild necessary.
* Policies and guidelines: N/A
* Trademark approval: N/A
[1] https://pagure.io/releng/issue/6883
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
https://fedoraproject.org/wiki/Changes/NSSDefaultFileFormatSql
Change owner(s):
* Kai Engert <kaie@redhat.com>
Change the NSS library default to use the sqlite based data storage,
when applications don't specify their preferred storage file format.
== Detailed Description ==
Applications that use the NSS library often use a database for storage
of keys, certificates and trust. NSS supports two different file
formats, one called DBM (based on berkeley DB files) and another one
called SQL (based on sqlite DB files).
Today's default file format used by NSS, used when applications omit
the type parameter, is the older DBM file format, which forbids
parallel access to the storage. The suggestion is to change the
default file format to SQL, which allows parallel access to the
storage.
Applications, or users using the NSS command line utilities, often
provide the database storage location using a simple directory path
parameter. Some might not be aware, or forget, that the parameter can
be prefixed with a type modifier, either "dbm:" or "sql:".
As a result, when not providing this parameter, the file format used
will be the fragile DBM file format. This is particuarly problematic,
if a user attempts to modify the NSS storage using command line tools,
while another process, such as a daemon, is running concurrently,
which also accesses the same database in the DBM file format. This
often results in corrupted database storage, which cannot be
recovered.
By changing the default, all applications that currently use the DBM
file format, will automatically be migrated to the SQL file format.
NSS has the ability to discover if a storage location (a directory)
contains the DBM file format. If configured to use the modern SQL
format, NSS will automatically perform a one-time conversion from the
DBM to the SQL format.
The same applies to the NSS command line utilities. If the NSS library
default is changed to SQL, the NSS tools will also trigger the
one-time conversion, or access the already converted files.
== Scope ==
* Proposal owners:
A small downstream patch needs to be applied to the NSS library
package, which changes the library default.
* Other developers:
It's up to developers of NSS applications, if they accept the new
default and an automatic conversion, or if they prefer to continue to
use the classic DBM storage format. Although not recommended,
developers can easily do so, by adding a "dbm:" prefix to the storage
parameter they provide to NSS at NSS library initialization time.
* Release engineering: [1]
No help should be necessary. No mass rebuild necessary.
* Policies and guidelines: N/A
* Trademark approval: N/A
[1] https://pagure.io/releng/issue/6883
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[CentOS-announce] CESA-2017:3071 Moderate CentOS 6 ntp Security Update
CentOS Errata and Security Advisory 2017:3071 Moderate
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3071
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
e2dc7d323fdff02674abf27c51cba5cd3bf2b9c9185851bc003ca2cb61234d0a ntp-4.2.6p5-12.el6.centos.1.i686.rpm
158ab373f5d0392f4e3168fc548d889218036ca71e3612c22fd655343a834dac ntpdate-4.2.6p5-12.el6.centos.1.i686.rpm
98157086964064a8175b71c4b70121a4109802cf5678b17b70c10e650d0b043d ntp-doc-4.2.6p5-12.el6.centos.1.noarch.rpm
bb7742afa687e7d0d0d2031d8dbfc938e1a239a65cc1d51da35d5321113688dc ntp-perl-4.2.6p5-12.el6.centos.1.i686.rpm
x86_64:
b90705825a7665764895b2b0f5f0fa253f3cd8053f7ba4e4bf22ea0eb60ad119 ntp-4.2.6p5-12.el6.centos.1.x86_64.rpm
5383d9b247aa508f0d02fa89e11e2e8a3760537f680d0323abd9af544d16d3e5 ntpdate-4.2.6p5-12.el6.centos.1.x86_64.rpm
98157086964064a8175b71c4b70121a4109802cf5678b17b70c10e650d0b043d ntp-doc-4.2.6p5-12.el6.centos.1.noarch.rpm
43f5fbf0dc6b734fca4848fc47bae07ff975b24929c8ad160383ed68dedcadce ntp-perl-4.2.6p5-12.el6.centos.1.x86_64.rpm
Source:
ad6efac5d8fa6c0476a3c2e19ef9e4660ba834bf7a411b668f05346167a5f483 ntp-4.2.6p5-12.el6.centos.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3071
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
e2dc7d323fdff02674abf27c51cba5cd3bf2b9c9185851bc003ca2cb61234d0a ntp-4.2.6p5-12.el6.centos.1.i686.rpm
158ab373f5d0392f4e3168fc548d889218036ca71e3612c22fd655343a834dac ntpdate-4.2.6p5-12.el6.centos.1.i686.rpm
98157086964064a8175b71c4b70121a4109802cf5678b17b70c10e650d0b043d ntp-doc-4.2.6p5-12.el6.centos.1.noarch.rpm
bb7742afa687e7d0d0d2031d8dbfc938e1a239a65cc1d51da35d5321113688dc ntp-perl-4.2.6p5-12.el6.centos.1.i686.rpm
x86_64:
b90705825a7665764895b2b0f5f0fa253f3cd8053f7ba4e4bf22ea0eb60ad119 ntp-4.2.6p5-12.el6.centos.1.x86_64.rpm
5383d9b247aa508f0d02fa89e11e2e8a3760537f680d0323abd9af544d16d3e5 ntpdate-4.2.6p5-12.el6.centos.1.x86_64.rpm
98157086964064a8175b71c4b70121a4109802cf5678b17b70c10e650d0b043d ntp-doc-4.2.6p5-12.el6.centos.1.noarch.rpm
43f5fbf0dc6b734fca4848fc47bae07ff975b24929c8ad160383ed68dedcadce ntp-perl-4.2.6p5-12.el6.centos.1.x86_64.rpm
Source:
ad6efac5d8fa6c0476a3c2e19ef9e4660ba834bf7a411b668f05346167a5f483 ntp-4.2.6p5-12.el6.centos.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Wednesday, October 25, 2017
[USN-3463-1] Werkzeug vulnerability
==========================================================================
Ubuntu Security Notice USN-3463-1
October 25, 2017
python-werkzeug vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Werkzeug could be made to run arbitrary code if it opened a
specially crafted file.
Software Description:
- python-werkzeug: collection of utilities for WSGI applications
Details:
It was discovered that Werkzeug did not properly handle certain
web scripts. A remote attacker could use this to inject arbitrary
code via a field that contains an exception message.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
python-werkzeug 0.10.4+dfsg1-1ubuntu1.1
python3-werkzeug 0.10.4+dfsg1-1ubuntu1.1
Ubuntu 14.04 LTS:
python-werkzeug 0.9.4+dfsg-1.1ubuntu2.1
python3-werkzeug 0.9.4+dfsg-1.1ubuntu2.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3463-1
CVE-2016-10516
Package Information:
https://launchpad.net/ubuntu/+source/python-werkzeug/0.10.4+dfsg1-1ub
untu1.1
https://launchpad.net/ubuntu/+source/python-werkzeug/0.9.4+dfsg-1.1ub
untu2.1
Ubuntu Security Notice USN-3463-1
October 25, 2017
python-werkzeug vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Werkzeug could be made to run arbitrary code if it opened a
specially crafted file.
Software Description:
- python-werkzeug: collection of utilities for WSGI applications
Details:
It was discovered that Werkzeug did not properly handle certain
web scripts. A remote attacker could use this to inject arbitrary
code via a field that contains an exception message.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
python-werkzeug 0.10.4+dfsg1-1ubuntu1.1
python3-werkzeug 0.10.4+dfsg1-1ubuntu1.1
Ubuntu 14.04 LTS:
python-werkzeug 0.9.4+dfsg-1.1ubuntu2.1
python3-werkzeug 0.9.4+dfsg-1.1ubuntu2.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3463-1
CVE-2016-10516
Package Information:
https://launchpad.net/ubuntu/+source/python-werkzeug/0.10.4+dfsg1-1ub
untu1.1
https://launchpad.net/ubuntu/+source/python-werkzeug/0.9.4+dfsg-1.1ub
untu2.1
[CentOS-announce] CEEA-2017:3052 CentOS 7 tzdata Enhancement Update
CentOS Errata and Enhancement Advisory 2017:3052
Upstream details at : https://access.redhat.com/errata/RHEA-2017:3052
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
c9f0d7fde7ab3952e0ba0343757b60f1477cf62074063cd9f35afeffc3d18032 tzdata-2017c-1.el7.noarch.rpm
f3dd206595a2476b7e11197263ef695d8844aaae58cbb4b39dc2a89a35ce8d7a tzdata-java-2017c-1.el7.noarch.rpm
Source:
501c2b5e270663d3803ef40654ae931e254e9fac61ef6a27a7d55faffe75cbfc tzdata-2017c-1.el7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHEA-2017:3052
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
c9f0d7fde7ab3952e0ba0343757b60f1477cf62074063cd9f35afeffc3d18032 tzdata-2017c-1.el7.noarch.rpm
f3dd206595a2476b7e11197263ef695d8844aaae58cbb4b39dc2a89a35ce8d7a tzdata-java-2017c-1.el7.noarch.rpm
Source:
501c2b5e270663d3803ef40654ae931e254e9fac61ef6a27a7d55faffe75cbfc tzdata-2017c-1.el7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Subscribe to:
Posts (Atom)