Friday, July 26, 2019

Fedora 31 Self-Contained Change proposal: Enable net.ipv4.ping_group_range in the kernel

https://fedoraproject.org/wiki/Changes/EnableSysctlPingGroupRange

(Note this change proposal was originally submitted before the
deadline, but was delayed due to some discussion between the change
owner and change wrangler)

== Summary ==
Enable the Linux kernel's <code>net.ipv4.ping_group_range</code>
parameter to cover all groups.

== Owner ==
* Name: [[User:rishi|Debarshi Ray]]
* Email: debarshir@redhat.com

== Detailed Description ==
Enable the Linux kernel's <code>net.ipv4.ping_group_range</code>
parameter to cover all groups. This will let all users on the
operating system create ICMP Echo sockets without using setuid
binaries, or having the <code>CAP_NET_ADMIN</code> and
<code>CAP_NET_RAW</code> file capabilities.

== Benefit to Fedora ==
This makes <code>ping</code> work inside rootless [https://podman.io/
Podman] containers. Currently it doesn't.

When the Linux kernel's <code>net.ipv4.ping_group_range</code>
parameter is enabled for a group, users in that group can send ICMP
Echo packets without using setuid binaries, or having the
<code>CAP_NET_ADMIN</code> and <code>CAP_NET_RAW</code> file
capabilities. This works by using
[http://man7.org/linux/man-pages/man7/icmp.7.html ICMP Echo] sockets
instead of the more generic, and easier to abuse,
[http://man7.org/linux/man-pages/man7/raw.7.html raw] sockets. For
Fedora, this means that the file capabilities can be removed from the
<code>ping</code> binary.

This is good for OSTree based Fedora variants like Silverblue, where
development environments are often set up using rootless Podman
containers with helpers like [https://github.com/debarshiray/toolbox
Toolbox]. At present, <code>ping</code> doesn't work in those
environments, and it's inconvenient to not be able to use such a basic
network utility inside a development set-up.

== Scope ==
* Proposal owners: Enable <code>net.ipv4.ping_group_range</code> by
adding it to one of the files shipped by the sytemd RPM in
<code>/usr/lib/sysctl.d</code> or by creating a new file shipped by
the podman or toolbox RPMs.
[https://github.com/systemd/systemd/pull/13141 Here] is an upstream
pull request against systemd.
* Other developers: Once this change is in place, the file
capabilities should be removed from the <code>ping</code> binary
because they would no longer be necessary. However, it's not a
requirement for implementing this change.
* Release engineering: N/A (not needed for this Change)
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)

== Upgrade/compatibility impact ==
Systems with a previous version of Fedora won't need manual
intervention. They will inherit this change when updated.

== How To Test ==
On a Fedora system containing this change, the following commands should work:
<pre>
$ podman run -it --rm registry.fedoraproject.org/fedora:latest
...
# dnf -y install iputils
...
# ping fedoraproject.org
...
</pre>

== User Experience ==
Users of rootless Podman, including those developing on Silverblue
inside Toolbox containers, would now be able to use <code>ping</code>.
Earlier, they weren't able to.

== Dependencies ==
N/A (not needed for this Change)

== Contingency Plan ==
* Contingency mechanism: If <code>net.ipv4.ping_group_range</code>
isn't enabled then status quo will be maintained. No explicit action
needs to be taken. Note that the <code>ping</code> binary should not
be touched until this change is complete. Only then should be the file
capabilities removed.
* Contingency deadline: N/A (not needed for this Change)
* Blocks release? No
* Blocks product? No

== Documentation ==
There's no upstream documentation. There's some discussion on
[https://github.com/systemd/systemd/pull/13141 this] systemd pull
request.



--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org

61263}reallost1.fbsd2233449}恒泰华游乐船业有限公司226675

Thursday, July 25, 2019

[USN-4076-1] Linux kernel vulnerabilities

==========================================================================
Ubuntu Security Notice USN-4076-1
July 25, 2019

linux, linux-aws, linux-kvm, linux-raspi2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-kvm: Linux kernel for cloud environments
- linux-raspi2: Linux kernel for Raspberry Pi 2

Details:

It was discovered that a race condition existed in the Serial Attached SCSI
(SAS) implementation in the Linux kernel. A local attacker could possibly
use this to cause a denial of service (system crash) or execute arbitrary
code. (CVE-2018-20836)

It was discovered that the ext4 file system implementation in the Linux
kernel did not properly zero out memory in some situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2019-11833)

It was discovered that the Bluetooth Human Interface Device Protocol (HIDP)
implementation in the Linux kernel did not properly verify strings were
NULL terminated in certain situations. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2019-11884)

It was discovered that the Linux kernel on ARM processors allowed a tracing
process to modify a syscall after a seccomp decision had been made on that
syscall. A local attacker could possibly use this to bypass seccomp
restrictions. (CVE-2019-2054)

Hugues Anguelkov discovered that the Broadcom Wifi driver in the Linux
kernel did not properly prevent remote firmware events from being processed
for USB Wifi devices. A physically proximate attacker could use this to
send firmware events to the device. (CVE-2019-9503)

It was discovered that an integer overflow existed in the Freescale
(PowerPC) hypervisor manager in the Linux kernel. A local attacker with
write access to /dev/fsl-hv could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2019-10142)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
linux-image-4.4.0-1052-kvm 4.4.0-1052.59
linux-image-4.4.0-1088-aws 4.4.0-1088.99
linux-image-4.4.0-1117-raspi2 4.4.0-1117.126
linux-image-4.4.0-157-generic 4.4.0-157.185
linux-image-4.4.0-157-generic-lpae 4.4.0-157.185
linux-image-4.4.0-157-lowlatency 4.4.0-157.185
linux-image-4.4.0-157-powerpc-e500mc 4.4.0-157.185
linux-image-4.4.0-157-powerpc-smp 4.4.0-157.185
linux-image-4.4.0-157-powerpc64-emb 4.4.0-157.185
linux-image-4.4.0-157-powerpc64-smp 4.4.0-157.185
linux-image-aws 4.4.0.1088.91
linux-image-generic 4.4.0.157.165
linux-image-generic-lpae 4.4.0.157.165
linux-image-kvm 4.4.0.1052.52
linux-image-lowlatency 4.4.0.157.165
linux-image-powerpc-e500mc 4.4.0.157.165
linux-image-powerpc-smp 4.4.0.157.165
linux-image-powerpc64-emb 4.4.0.157.165
linux-image-powerpc64-smp 4.4.0.157.165
linux-image-raspi2 4.4.0.1117.117
linux-image-virtual 4.4.0.157.165

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://usn.ubuntu.com/4076-1
CVE-2018-20836, CVE-2019-10142, CVE-2019-11833, CVE-2019-11884,
CVE-2019-2054, CVE-2019-9503

Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-157.185
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1088.99
https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1052.59
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1117.126

[USN-4054-2] Firefox regressions

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEERN//5MGgCOgyKeIFYR+97NWUbg8FAl06Dd0ACgkQYR+97NWU
bg/lgwf/R+0qNt65Zzc1VixPR94TaQdWV/7knmgQwL5KbEEfOUJlGzHtPeZzZtVq
zCddWXO/q6Oc2GYbIBg7lddjPLnk+1Hxptc791Qyjcar1ETQ9YKySbn2yDkySfHg
Gg/OvGxMcC8wmUZEUqj+yaFcw7p0fboXnz45Puc7F5v85NY9SdGd4e6+ROkuTaEI
5YrsyUVDkXwY662YG1bRbj+TdIr/UOxlwP8FIL1CuZX3mjCtqPLQx8gGOjf14iSp
qj5xAxnzbl8Aad02moVpdQsaCD7jqT820MyeDv+t14b4gJCK+yTw2zGSFLZbglS8
mViSn8gZi9JQK2piSwdSn4RrW7KDiA==
=BXEO
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4054-2
July 25, 2019

firefox regressions
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

USN-4054-1 caused some minor regressions in Firefox.

Software Description:
- firefox: Mozilla Open Source web browser

Details:

USN-4054-1 fixed vulnerabilities in Firefox. The update introduced
various minor regressions. This update fixes the problems.

We apologize for the inconvenience.

Original advisory details:

 A sandbox escape was discovered in Firefox. If a user were tricked in to
 installing a malicious language pack, an attacker could exploit this to
 gain additional privileges. (CVE-2019-9811)
 
 Multiple security issues were discovered in Firefox. If a user were
 tricked in to opening a specially crafted website, an attacker could
 potentially exploit these to cause a denial of service, obtain sensitive
 information, bypass same origin restrictions, conduct cross-site scripting
 (XSS) attacks, conduct cross-site request forgery (CSRF) attacks, spoof
 origin attributes, spoof the addressbar contents, bypass safebrowsing
 protections, or execute arbitrary code. (CVE-2019-11709, CVE-2019-11710,
 CVE-2019-11711, CVE-2019-11712, CVE-2019-11713, CVE-2019-11714,
 CVE-2019-11715, CVE-2019-11716, CVE-2019-11717, CVE-2019-11718,
 CVE-2019-11719, CVE-2019-11720, CVE-2019-11721, CVE-2019-11723,
 CVE-2019-11724, CVE-2019-11725, CVE-2019-11727, CVE-2019-11728,
 CVE-2019-11729)
 
 It was discovered that Firefox treats all files in a directory as same
 origin. If a user were tricked in to downloading a specially crafted HTML
 file, an attacker could potentially exploit this to obtain sensitive
 information from local files. (CVE-2019-11730)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  firefox                         68.0.1+build1-0ubuntu0.19.04.1

Ubuntu 18.04 LTS:
  firefox                         68.0.1+build1-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
  firefox                         68.0.1+build1-0ubuntu0.16.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.

References:
  https://usn.ubuntu.com/4054-2
  https://usn.ubuntu.com/4054-1
  https://launchpad.net/bugs/1837941

Package Information:
 
https://launchpad.net/ubuntu/+source/firefox/68.0.1+build1-0ubuntu0.19.04.1
 
https://launchpad.net/ubuntu/+source/firefox/68.0.1+build1-0ubuntu0.18.04.1
 
https://launchpad.net/ubuntu/+source/firefox/68.0.1+build1-0ubuntu0.16.04.1

[USN-4075-1] Exim vulnerability

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl053dcACgkQZWnYVadE
vpNSdg/8CQgxpGfPB1EclO5j2nNxpU3UUz/eIqB0hGZZQsXEjEc52XOCkUjgJQ47
4mA0pYr6PUXS0VhyCNIuk09IzOQsivcZ9JX9PkOVEzFhM/3b3GG6rxIlfj+Lwgse
W1iT91jFZuzh4o4Fw0/eNfyZJRSghHrYF38WA8M/whMruRvXW1+StjaGhGT2+gj0
FwUMu9EkFEF7T0QSDCendajaU/yrd3PjKWQzOMTlJqnjWFfFSofU2d/VrEiD2lq0
0seByCYota3f8Vcv11ihva/e8GNjLVac4Ie9vaffuE2xne5rPOrtVr1ktiSOHIhK
Io7dt/ZWDQKxiXecOsg6PkT3/fAV25rC563dDyIwYkQqwnjEuh1TunPnb4VPIr5Y
riueb1SwbmLQ2YGbbbPHI+ztj9sFodggdlrzFELFNu0o59E/f80DtwHHURA6gFfM
tzeiBzHPhgq0JetdADzulp/4FoYs+ueQkbYQyNsJ53PtkQZac6PPE7R0sxJEQ3y/
nfcyzae/xTVW9SSevtieQ4B/YOQ4bYovEUtb43RdUNrATxZ38AAg3VUfrUcLWRY5
MVr4XLNFq/EEBhU+OuQ3At9MhxLn5BTXgQIG4iz8Yf/cUlefpo+/0BLt+7CtT8+h
DLjeYzYhv7D0eV8zm4wARdP+oRGFW6naEkcaK++o+Yf7KkwUUXA=
=jiwY
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4075-1
July 25, 2019

exim4 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Exim could be made to run programs as an administrator if it received
specially crafted network traffic.

Software Description:
- exim4: Exim is a mail transport agent

Details:

Jeremy Harris discovered that Exim incorrectly handled sort expansions. In
environments where sort expansions are used, a remote attacker could
possibly use this issue to execute arbitrary code as root.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
exim4-daemon-heavy 4.92-4ubuntu1.2
exim4-daemon-light 4.92-4ubuntu1.2

Ubuntu 18.04 LTS:
exim4-daemon-heavy 4.90.1-1ubuntu1.3
exim4-daemon-light 4.90.1-1ubuntu1.3

Ubuntu 16.04 LTS:
exim4-daemon-heavy 4.86.2-2ubuntu2.4
exim4-daemon-light 4.86.2-2ubuntu2.4

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4075-1
CVE-2019-13917

Package Information:
https://launchpad.net/ubuntu/+source/exim4/4.92-4ubuntu1.2
https://launchpad.net/ubuntu/+source/exim4/4.90.1-1ubuntu1.3
https://launchpad.net/ubuntu/+source/exim4/4.86.2-2ubuntu2.4

[USN-4074-1] VLC vulnerabilities

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl05xZcACgkQZWnYVadE
vpP7Pw//TaZecr8nSrWTzkGjXcrdu3zFx3HJcaV7A1HSlhP69/vI6l8M684+y39X
NkvrAyeFxUrpJHXxKu8zvB8gog/fmj1R95WvzE8ixNpHOEJqIoEhkZO+LBjPj+9D
JG9B21b8sXvhPJeiwjOYaTALM03qrM1iN+EV+izFJaDBCHZt2BJUw299/8EOYef4
TjW/ZOpuZYGCH9KZwE+IIwi4K/xG6n2eFtEqHw6CzEiHnTW/u3+zcWmElnsh0/Im
/2+Z5vTfH7ibnZkChcnPt0XFzxgBv3V+gM6yD5kOpQbrWpr6xgUB9dH9R1wZjIoo
VHFOCjQ0lzj3QZdceuYcB9K8CNmbWQ3e+IVrcn8kX2ZeyvbLrqYXmQKQhrA0LO9E
M96Wi9ggQjr0fGZ1buT0TYNnCxhga/6Z3/OdL30whfG8ODhcDPpmK2eC/f+6mczM
fGG54HwOGTzLhMRIwjUICitu4dw6+SNbXXtXOnit3LKrUmyrXcywsk/N/H6wfYJ8
1rKVXI1wte+Ib661U/Nm+TBvVwJYMNehAU8TPuf2EuGuyg3Q72pURL+WdHa7I5cG
ciwnq4XD1wqr6OkIUMHciqkHm29YmCyTRnRFe8UIP48SIErRc9wW25iFir/z3dsr
FkfmoMQvhQBS7lXI0eOudUQEEQYiGm1SQQ07wmMRjMTGbA3lvZ8=
=jLyC
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4074-1
July 25, 2019

vlc vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in VLC.

Software Description:
- vlc: multimedia player and streamer

Details:

It was discovered that the VLC CAF demuxer incorrectly handled certain
files. If a user were tricked into opening a specially-crafted CAF file, a
remote attacker could use this issue to cause VLC to crash, resulting in a
denial of service. This issue only affected Ubuntu 18.04 LTS.
(CVE-2018-19857)

It was discovered that the VLC Matroska demuxer incorrectly handled certain
files. If a user were tricked into opening a specially-crafted MKV file, a
remote attacker could use this issue to cause VLC to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2019-12874)

It was discovered that the VLC MP4 demuxer incorrectly handled certain
files. If a user were tricked into opening a specially-crafted MP4 file, a
remote attacker could use this issue to cause VLC to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2019-13602)

It was discovered that the VLC AVI demuxer incorrectly handled certain
files. If a user were tricked into opening a specially-crafted AVI file, a
remote attacker could use this issue to cause VLC to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2019-5439)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
vlc 3.0.7.1-0ubuntu19.04.1

Ubuntu 18.04 LTS:
vlc 3.0.7.1-0ubuntu18.04.1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4074-1
CVE-2018-19857, CVE-2019-12874, CVE-2019-13602, CVE-2019-5439

Package Information:
https://launchpad.net/ubuntu/+source/vlc/3.0.7.1-0ubuntu19.04.1
https://launchpad.net/ubuntu/+source/vlc/3.0.7.1-0ubuntu18.04.1

[USN-4073-1] libEBML vulnerability

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl05xX0ACgkQZWnYVadE
vpO3/A//RD8JI0BgWW/jv2RHwoxFUzcmvrz7sYzqw/njlLji8+CWRa9BZ2+e5GoJ
fOs2dcsFbT9dxmO41jv21j1fa8mbXEOoLqOYTmklr+8bcdHAUd8QjQYSQbg5QYD7
JCF7OBAOh5Mcqa4snY1GFUH6QvMyEN6jCiOvJrAt79jlhjD8iWSPqUF/qBk0jQ15
UNYlfO0O/BtY3RpkuziEvWXwGuSCfnardTP1hSkC9Wki5/wNHVDDP3KMdttWPFY3
Ql2qRxgYmhE0G6XrQYMwYxcMnjCdyYkW9apy2N4XYtJ3trgILMentmiuYujun+K4
dc8cXsOfjQB0D7Nop3PwSWWTEIzOttsgzPT+ozucHTpRp3C1n3FhkaJMQEBqQrZX
EQvkwZDD5vn+YFWh8XyH8/CBMMbO9bknqv40IoR/SNk40XVC9NQ0owNtnmD6bATw
06f1UqcwNuRWVOF3z/XS9pAtWj/Qpmk0ObTbPkgo+ecsHqDi7AFcm5svNmA/L4qE
Z9A+bSL8Hv/ImroAP4c+hO7KVvkMm4b3b/zxtMiEZcUksd5kz9BOFDrNptvYAXuB
JRnAd3LtKm/HlRBnuYZjaWyxOLvpz7cF8TLyLAbo1arqoiR05l7fmQvBR5bmi5R5
ISHaQYMtDB3rRfMfCiqEM1vCIJIC5/pZvq9feADyl/pwA79xU3A=
=062e
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4073-1
July 25, 2019

libebml vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

libEBML could be made to crash if it opened a specially crafted file.

Software Description:
- libebml: library for the EBML format

Details:

It was discovered that libEBML incorrectly handled certain media files. If
a user were tricked into opening a specially crafted media file, libEBML
could possibly be made to crash, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
libebml4v5 1.3.5-2ubuntu0.1

Ubuntu 16.04 LTS:
libebml4v5 1.3.3-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4073-1
CVE-2019-13615

Package Information:
https://launchpad.net/ubuntu/+source/libebml/1.3.5-2ubuntu0.1
https://launchpad.net/ubuntu/+source/libebml/1.3.3-1ubuntu0.1

Re: Rolling out Phase I of rawhide package gating

Good Morning Everyone,

I just wanted to let everyone know that this is now live.
You can see all the updates going through (or not) to rawhide in:
https://bodhi.fedoraproject.org/releases/F31

Many many thanks to all the people involved, I'm afraid I'll miss some but I'll
take the risk, so here it is (in no particular order):
Many thanks to Clément, Aurélien, Kevin, Nils, Mohan, Michal, Randy, Ryan,
Patrick, smooge, Troy and of course Leigh, Jim and Paul who have made this
possible.


I'm keeping the point from the FAQ about where to report issues, if you run into
any, here as it may now come in handy ;-)

> Small FAQ:
> --------------
[...]
> It does not work!
> Bugs will be bugs. This is the first roll-out of this change, and more will
> come. This rollout lets us gather feedback and iterate on the approach in an
> open source fashion.
> If you did not opt-in and you can't do your packaging work as you used to,
> please file a infrastructure ticket, since it's likely a bug:
> https://pagure.io/fedora-infrastructure/new_issue?title=[CI]
> If you did opt-in and something in the gating of your update doesn't work (for
> example, CI ran but its results aren't being considered, waiving didn't work…),
> file an infrastructure ticket:
> https://pagure.io/fedora-infrastructure/new_issue?title=[CI]
> If you opted-in and the tests don't run the way you expect, file a fedora-ci
> ticket: https://pagure.io/fedora-ci/general/new_issue


Happy packaging!

Pierre

Wednesday, July 24, 2019

[USN-4072-1] Ansible vulnerabilities

==========================================================================
Ubuntu Security Notice USN-4072-1
July 24, 2019

ansible vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Ansible.

Software Description:
- ansible: Configuration management, deployment, and task execution system

Details:

It was discovered that Ansible failed to properly handle sensitive information.
A local attacker could use those vulnerabilities to extract them.
(CVE-2017-7481)
(CVE-2018-10855)
(CVE-2018-16837)
(CVE-2018-16876)
(CVE-2019-10156)

It was discovered that Ansible could load configuration files from the current
working directory containing crafted commands. An attacker could run arbitrary
code as result.
(CVE-2018-10874)
(CVE-2018-10875)

It was discovered that Ansible fetch module had a path traversal vulnerability.
A local attacker could copy and overwrite files outside of the specified
destination.
(CVE-2019-3828)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
ansible 2.7.8+dfsg-1ubuntu0.19.04.1

Ubuntu 18.04 LTS:
ansible 2.5.1+dfsg-1ubuntu0.1

Ubuntu 16.04 LTS:
ansible 2.0.0.2-2ubuntu1.3

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4072-1
CVE-2017-7481, CVE-2018-10855, CVE-2018-10874, CVE-2018-10875,
CVE-2018-16837, CVE-2018-16876, CVE-2019-10156, CVE-2019-3828

Package Information:
https://launchpad.net/ubuntu/+source/ansible/2.7.8+dfsg-1ubuntu0.19.04.1
https://launchpad.net/ubuntu/+source/ansible/2.5.1+dfsg-1ubuntu0.1
https://launchpad.net/ubuntu/+source/ansible/2.0.0.2-2ubuntu1.3

[CentOS-announce] CESA-2019:1815 Moderate CentOS 7 java-1.8.0-openjdk Security Update

CentOS Errata and Security Advisory 2019:1815 Moderate

Upstream details at : https://access.redhat.com/errata/RHSA-2019:1815

The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )

x86_64:
4db61ec83854e045dc727d41be296d2635e5a66cca3812ca8ba125ed5e2963ea java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.i686.rpm
095bf9e6de046eaf763448e75f8183521f67d16603c15af35f39920330b4f963 java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64.rpm
54f731d38f0cb6e9c24200c859d083bbcc71386ec58a07d046eebea08e17384a java-1.8.0-openjdk-accessibility-1.8.0.222.b10-0.el7_6.i686.rpm
0778b186d729d47635d35029244b79a31ed69c1bae5881a08753ac4bbfbf52b2 java-1.8.0-openjdk-accessibility-1.8.0.222.b10-0.el7_6.x86_64.rpm
4ace6c8f30a0ad783184900f1e8a9e81f22bf6ecc54298c530dd694a8e45543b java-1.8.0-openjdk-accessibility-debug-1.8.0.222.b10-0.el7_6.i686.rpm
8d5d123358de51e1fd3063e87fb2261c79478df42542ff2e36a84130b5bac498 java-1.8.0-openjdk-accessibility-debug-1.8.0.222.b10-0.el7_6.x86_64.rpm
1b3a0d7fa10934b7162cf319c260915dfe7780668db2e8a193c51de89745596f java-1.8.0-openjdk-debug-1.8.0.222.b10-0.el7_6.i686.rpm
c7251e19e97517b21ef82ac69559751eb5bb89382d15b77f6e68e2f3d77fc026 java-1.8.0-openjdk-debug-1.8.0.222.b10-0.el7_6.x86_64.rpm
87f61281d0123fc8cfd3d82409232efa0aa8f0baffbf9396d7d23d0314d89d9c java-1.8.0-openjdk-demo-1.8.0.222.b10-0.el7_6.i686.rpm
498cb49b364d08872003e3b85e995db2a083d0c31fe3ab7263acd9cc6d3632d2 java-1.8.0-openjdk-demo-1.8.0.222.b10-0.el7_6.x86_64.rpm
05eb6f3b1d31c093647d0439c0e48b05e8261289eee180b189b8b44654df42ff java-1.8.0-openjdk-demo-debug-1.8.0.222.b10-0.el7_6.i686.rpm
b20d575507486c24acd61895fe7c44867735ff79dc37bde68e1be5ec456b850b java-1.8.0-openjdk-demo-debug-1.8.0.222.b10-0.el7_6.x86_64.rpm
9d068f9c6589f15b873038c571a43d07573b2b6f0b044b49c963cbb958c3439e java-1.8.0-openjdk-devel-1.8.0.222.b10-0.el7_6.i686.rpm
97f32b87e11f746204f2fbefffa6ad1916b3fe41410407876bbea6d36adaaf62 java-1.8.0-openjdk-devel-1.8.0.222.b10-0.el7_6.x86_64.rpm
e427b48300d08ae1fd3f5b1521beb7601775c1d0bb5d5b5157155574c4c335b6 java-1.8.0-openjdk-devel-debug-1.8.0.222.b10-0.el7_6.i686.rpm
476e9adc2505e37a992ee570098e60a6cd6eb67707ea7e1402757a01fc19a5ff java-1.8.0-openjdk-devel-debug-1.8.0.222.b10-0.el7_6.x86_64.rpm
559d3f0ea2e910ad2a6147141aa8ad79aa8b3d888601e7f0c7e0bc71453bdb93 java-1.8.0-openjdk-headless-1.8.0.222.b10-0.el7_6.i686.rpm
cbc3df1511e403da3050c4193e32737c67cb88383f5aad6562ab08c01e36aa4c java-1.8.0-openjdk-headless-1.8.0.222.b10-0.el7_6.x86_64.rpm
9e85ba56216a879a930c34874ae423d1d37e1186cf2db827eaaab2758620d8e4 java-1.8.0-openjdk-headless-debug-1.8.0.222.b10-0.el7_6.i686.rpm
12b267daa9f0540bec4a47ac64a63f59a13aca726d9ade1c57aa196dd276b0e8 java-1.8.0-openjdk-headless-debug-1.8.0.222.b10-0.el7_6.x86_64.rpm
71557918f6a63b7f3a9cf5754420e68ca79c226b0e1c1c306106fdada9d65171 java-1.8.0-openjdk-javadoc-1.8.0.222.b10-0.el7_6.noarch.rpm
d14041683772566d01b2ecb7c81a7a39e6bf0a35b77dd6bb285f17f54608e183 java-1.8.0-openjdk-javadoc-debug-1.8.0.222.b10-0.el7_6.noarch.rpm
da40d5d4cebad3b16e9b92fc84ad0050d3e8fa431a1e93f500af8844d47865c7 java-1.8.0-openjdk-javadoc-zip-1.8.0.222.b10-0.el7_6.noarch.rpm
944122bf8f8bbb4e3324b55cbe184e8da3130c32431adcc0c7d1a9f5f7d5317a java-1.8.0-openjdk-javadoc-zip-debug-1.8.0.222.b10-0.el7_6.noarch.rpm
e09940451401fa176d2513c782b315d1c9f91e0ceffb0ab045873f13f1e8ba67 java-1.8.0-openjdk-src-1.8.0.222.b10-0.el7_6.i686.rpm
0572e3ca55507a10bfa80fda7a0beaf533391abea1f66d4b30b35b3b228514ec java-1.8.0-openjdk-src-1.8.0.222.b10-0.el7_6.x86_64.rpm
37e4441a583cf6279747e9c4acf2defec7d1f52a3d80163479500f302401bf69 java-1.8.0-openjdk-src-debug-1.8.0.222.b10-0.el7_6.i686.rpm
d4a1d88b0c40f2ffc3c52e7666b61e1781cfb4bff6857532c4a42d24209d95e9 java-1.8.0-openjdk-src-debug-1.8.0.222.b10-0.el7_6.x86_64.rpm

Source:
183b776d452084498516e31a865fe337a8f909a85227027994c65bfba34058b1 java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.src.rpm



--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS

_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce

[CentOS-announce] CESA-2019:1839 Moderate CentOS 7 java-1.7.0-openjdk Security Update

CentOS Errata and Security Advisory 2019:1839 Moderate

Upstream details at : https://access.redhat.com/errata/RHSA-2019:1839

The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )

x86_64:
c340940ce3b0ef82428351f13d8f1309d7596f6725358465d076e2b3bf38339f java-1.7.0-openjdk-1.7.0.231-2.6.19.1.el7_6.x86_64.rpm
57c3d77aecd07a664e798a3e00ed90a54a32dad86a349639181b4920aea28adc java-1.7.0-openjdk-accessibility-1.7.0.231-2.6.19.1.el7_6.x86_64.rpm
460aa8eb4fa2c38de662feac34ae0dfaa5dc8d87dc996ef8e66b08b7a4d468d5 java-1.7.0-openjdk-demo-1.7.0.231-2.6.19.1.el7_6.x86_64.rpm
dd6bfe0e457e665fde50299a6333efb7f3bbfe43ef5aaeec31b50693c89e74cf java-1.7.0-openjdk-devel-1.7.0.231-2.6.19.1.el7_6.x86_64.rpm
40632cf8d97f12c601c8e6ae8edf9c397a27bbb925ec5e1e41722f1d244c1dc6 java-1.7.0-openjdk-headless-1.7.0.231-2.6.19.1.el7_6.x86_64.rpm
350adb28bc2409655fbc20333f4b020638182e2514fd6b51493eb4ad7bb10531 java-1.7.0-openjdk-javadoc-1.7.0.231-2.6.19.1.el7_6.noarch.rpm
5ba1932ee88a168308fefbe974e1ad0c04cbac3ac51515d93ecda8bdad932fe8 java-1.7.0-openjdk-src-1.7.0.231-2.6.19.1.el7_6.x86_64.rpm

Source:
a56aaa5e6c49dc199d7e77ff675efc71dec458099dc9f3e4a311417c7ff29222 java-1.7.0-openjdk-1.7.0.231-2.6.19.1.el7_6.src.rpm



--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS

_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce

[CentOS-announce] CESA-2019:1810 Moderate CentOS 7 java-11-openjdk Security Update

CentOS Errata and Security Advisory 2019:1810 Moderate

Upstream details at : https://access.redhat.com/errata/RHSA-2019:1810

The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )

x86_64:
acffb84be13020630e18b99479e343d934500334c20da5c967c15fbd888f6f26 java-11-openjdk-11.0.4.11-0.el7_6.i686.rpm
fd4baf69ea5578f1273110dce7b971c2f02386856b7388722b33ab229ca4597c java-11-openjdk-11.0.4.11-0.el7_6.x86_64.rpm
af2832f3ee90d96f2272b6051c7c2b9c783c590446483ff7a52995b656e0923b java-11-openjdk-debug-11.0.4.11-0.el7_6.i686.rpm
0ca83922672dab66dfdc6a4240b7d3e73478970d113ad1e3b7f9d96ca8b6d347 java-11-openjdk-debug-11.0.4.11-0.el7_6.x86_64.rpm
546322a9b20b1db59ea8a0cea2909ac33fe98936040b5ee7a328ea1cd0f956d7 java-11-openjdk-demo-11.0.4.11-0.el7_6.i686.rpm
7c79ab037b2192d61b781dbc53c070d61d8180b14de7c35d30d2b249b063fb67 java-11-openjdk-demo-11.0.4.11-0.el7_6.x86_64.rpm
1108531c4729485dcc6f8ee3b2807f66a08671c36a8f896a58dfaf77ac03e1e3 java-11-openjdk-demo-debug-11.0.4.11-0.el7_6.i686.rpm
dbf4ad1d09d4bfe380250ac31dfb563c44a62e8c97fb7361fe01a8397ef6d821 java-11-openjdk-demo-debug-11.0.4.11-0.el7_6.x86_64.rpm
a171124729255a5b92b9372ff094bf1fb107f4dbab95e96810b9786a99162aa9 java-11-openjdk-devel-11.0.4.11-0.el7_6.i686.rpm
0c5c6aab9d9bdc2df8b3fa106e2269998df670c159b1e7ac47118ba8caae8197 java-11-openjdk-devel-11.0.4.11-0.el7_6.x86_64.rpm
5212c43f72137f885cac10fc9bd3de3349bae54b4511970cf85296c83ad9535e java-11-openjdk-devel-debug-11.0.4.11-0.el7_6.i686.rpm
4a3d33a185d7b6280dca3194798ace197d1e863674fc3fc2ff62fe5267485ed1 java-11-openjdk-devel-debug-11.0.4.11-0.el7_6.x86_64.rpm
74732df06ad5b85881a084ffcd45b7f95e04fd2b972292be2e18acd8f8d053ca java-11-openjdk-headless-11.0.4.11-0.el7_6.i686.rpm
45e757a884e4970c7c5a5bc2a3612bea293c2bc041d3698525e3d859c1395b46 java-11-openjdk-headless-11.0.4.11-0.el7_6.x86_64.rpm
455046a0218a3da01cd16823a19fbbe905328a4f83177cfb2a4eac6d47e9aff9 java-11-openjdk-headless-debug-11.0.4.11-0.el7_6.i686.rpm
a9e1cbe5fa5751d6d13309df41c92238edbad6e7e1cad69357d42de767b49a3f java-11-openjdk-headless-debug-11.0.4.11-0.el7_6.x86_64.rpm
b73e590510b5ddb3adcb6e9ac64816c351cb52cf2478035acd502689125b24fe java-11-openjdk-javadoc-11.0.4.11-0.el7_6.i686.rpm
9af0154471fbb70ae482f3a784d142cf4b53fcf61df2a2f6874572f76523966c java-11-openjdk-javadoc-11.0.4.11-0.el7_6.x86_64.rpm
fc6560b86a665fedcef82bf6a4793b54085766b99ec74bd7e488c64a88a9bfdf java-11-openjdk-javadoc-debug-11.0.4.11-0.el7_6.i686.rpm
28f64caaf26970bc4590aa5baf0e6ec4a45fcd1e243c4e6e8f2e670508fc2805 java-11-openjdk-javadoc-debug-11.0.4.11-0.el7_6.x86_64.rpm
c7b50987e1d90e769cea71786605525dba4ba08c2bd38000b20a38fc81bd530a java-11-openjdk-javadoc-zip-11.0.4.11-0.el7_6.i686.rpm
b320536ec608c786032aadbdd1bc7370ef5f3cec770968b8f6415142fd09d9d4 java-11-openjdk-javadoc-zip-11.0.4.11-0.el7_6.x86_64.rpm
934624f8d14f1e2af670e8be125dc69f1f2cf1c58cad7cf5560930752560398d java-11-openjdk-javadoc-zip-debug-11.0.4.11-0.el7_6.i686.rpm
c88bae0a1b22d46ca2bfe6afde4dc3f3ea94bb0822fa67b0ed77e48a6487bdab java-11-openjdk-javadoc-zip-debug-11.0.4.11-0.el7_6.x86_64.rpm
1548f746e8fbfdb5fd8046a40d12c7bdff49ca95026c7a6b5ffd43ee8c7cce79 java-11-openjdk-jmods-11.0.4.11-0.el7_6.i686.rpm
54fb5a12a93779b75228d850e757e68b46e23164d1092ce4e0e6442b9066c0c1 java-11-openjdk-jmods-11.0.4.11-0.el7_6.x86_64.rpm
f5a8b9cae75ff8160b41794a196d0d5d819388aa7f9b6f974597266097bb678c java-11-openjdk-jmods-debug-11.0.4.11-0.el7_6.i686.rpm
bf3c1a7bcfcc27bd1152400512ab43349a2cfd0fa12a00dcd10ef36ec3834925 java-11-openjdk-jmods-debug-11.0.4.11-0.el7_6.x86_64.rpm
ba03e70a515bdf9f6b73e07ede19ef4797c871bd424429cb8a003deb40bd47bb java-11-openjdk-src-11.0.4.11-0.el7_6.i686.rpm
9eaeee0e53a2a8ab81aa142901d8c9e396ab9716666f5d5c455dc81f2f54fea6 java-11-openjdk-src-11.0.4.11-0.el7_6.x86_64.rpm
1fb30599f3d15d989b05c875025a8003ce7cb1ca2cee7c4fd797a14cdb56f995 java-11-openjdk-src-debug-11.0.4.11-0.el7_6.i686.rpm
2e2c0cd8191cefe5b3f4e203bbda579e47aab841e1029b73505101cd43966071 java-11-openjdk-src-debug-11.0.4.11-0.el7_6.x86_64.rpm

Source:
ee5938a89dfab6b7e3b51954aca70e13be95b66439b46a03174bb815ba66b0d8 java-11-openjdk-11.0.4.11-0.el7_6.src.rpm



--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS

_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce