epel-devel February 2013

epel-devel@lists.fedoraproject.org

17 participants
43 discussions

Fedora EPEL 5 updates-testing report
by updates＠fedoraproject.org 01 Feb '13

01 Feb '13

The following Fedora EPEL 5 Security updates need testing: Age URL 10 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0148/drupal7-7.19-… 285 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5630/bugzilla-3.2.… 180 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6608/Django-1.1.4-… 62 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-13612/drupal6-ctoo… 8 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0171/moodle-1.9.19… 8 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0173/couchdb-1.0.4… 10 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0116/drupal6-6.28-… 10 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0139/proftpd-1.3.3… 0 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0237/wordpress-3.5… The following builds have been pushed to Fedora EPEL 5 updates-testing drupal7-date_ical-2.3-1.el5 jglobus-2.0.5-0.1.rc2.el5 wordpress-3.5.1-1.el5.1 Details about builds: ================================================================================ drupal7-date_ical-2.3-1.el5 (FEDORA-EPEL-2013-0229) Allows creation of an iCal feed in Views -------------------------------------------------------------------------------- Update Information: Update to upstream 2.3 release Update to upstream 2.2 release -------------------------------------------------------------------------------- ChangeLog: -------------------------------------------------------------------------------- References: [ 1 ] Bug #904736 - drupal7-date_ical-2.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=904736 [ 2 ] Bug #903583 - drupal7-date_ical-2.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=903583 -------------------------------------------------------------------------------- ================================================================================ jglobus-2.0.5-0.1.rc2.el5 (FEDORA-EPEL-2013-0236) Globus Java client libraries -------------------------------------------------------------------------------- Update Information: JGlobus version 2.0.5 release candidate 2. New packages jglobus-myproxy and jglobus-axisg -------------------------------------------------------------------------------- ChangeLog: * Tue Jan 29 2013 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 2.0.5-0.1.rc2 - 2.0.5 release candidate 2 - New jglobus-myproxy package - New jglobus-axisg package -------------------------------------------------------------------------------- ================================================================================ wordpress-3.5.1-1.el5.1 (FEDORA-EPEL-2013-0237) Blog tool and publishing platform -------------------------------------------------------------------------------- Update Information: WordPress 3.5.1 is now available. Version 3.5.1 is the first maintenance release of 3.5, fixing 37 bugs. It is also a security release for all previous WordPress versions. Which include: * Editor: Prevent certain HTML elements from being unexpectedly removed or modified in rare cases. * Media: Fix a collection of minor workflow and compatibility issues in the new media manager. * Networks: Suggest proper rewrite rules when creating a new network. * Prevent scheduled posts from being stripped of certain HTML, such as video embeds, when they are published. * Work around some misconfigurations that may have caused some JavaScript in the WordPress admin area to fail. * Suppress some warnings that could occur when a plugin misused the database or user APIs. WordPress 3.5.1 also addresses the following security issues: * A server-side request forgery vulnerability and remote port scanning using pingbacks. This vulnerability, which could potentially be used to expose information and compromise a site, affects all previous WordPress versions. This was fixed by the WordPress security team. We’d like to thank security researchers Gennady Kovshenin and Ryan Dewhurst for reviewing our work. * Two instances of cross-site scripting via shortcodes and post content. These issues were discovered by Jon Cave of the WordPress security team. * A cross-site scripting vulnerability in the external library Plupload. Thanks to the Moxiecode team for working with us on this, and for releasing Plupload 1.5.5 to address this issue. -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 30 2013 Remi Collet <rcollet(a)redhat.com> - 3.5.1-1.1 - fix simplepie links (for all branches) * Wed Jan 30 2013 Remi Collet <rcollet(a)redhat.com> - 3.5.1-1 - version 3.5.1, various bug and security fixes: CVE-2013-0235, CVE-2013-0236 and CVE-2013-0237 - drop -f option from rm to break build if upstream archive content change - protect akismet content (from upstream .htaccess) * Wed Jan 2 2013 Remi Collet <rcollet(a)redhat.com> - 3.5-3 - fix links to system PHPMailer library -------------------------------------------------------------------------------- References: [ 1 ] Bug #904120 - CVE-2013-0235 wordpress: Server-side request forgery and remote port scanning using pingbacks https://bugzilla.redhat.com/show_bug.cgi?id=904120 [ 2 ] Bug #904121 - wordpress: XSS flaws via shortcodes and HTTP POST content https://bugzilla.redhat.com/show_bug.cgi?id=904121 [ 3 ] Bug #904122 - wordpress: XSS in the external Plupload library https://bugzilla.redhat.com/show_bug.cgi?id=904122 --------------------------------------------------------------------------------

1 0

Fedora EPEL 6 updates-testing report
by updates＠fedoraproject.org 01 Feb '13

01 Feb '13

The following Fedora EPEL 6 Security updates need testing: Age URL 285 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5620/bugzilla-3.4.… 8 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0174/tinymce-spell… 8 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0193/couchdb-1.0.4… 8 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0194/seamonkey-2.1… 62 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-13610/drupal6-ctoo… 207 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6348/bcfg2-1.2.3-1… 473 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2011-4701/supybot-gribb… 10 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0123/python-tw2-jq… 10 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0128/php-symfony2-… 10 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0157/proftpd-1.3.3… 10 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0144/zabbix-1.8.16… 10 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0170/asterisk-1.8.… 10 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0155/zabbix20-2.0.… 10 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0141/drupal7-7.19-… 0 https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-0233/wordpress-3.5… The following builds have been pushed to Fedora EPEL 6 updates-testing drupal7-date_ical-2.3-1.el6 gdb-heap-0.5-9.1.el6 guacd-0.7.0-3.el6 jglobus-2.0.5-0.1.rc2.el6 librcc-0.2.10-2.el6 ovirt-engine-sdk-3.2.0.8-1.el6 php-horde-Horde-Cli-2.0.3-1.el6 php-horde-Horde-Date-2.0.3-1.el6 php-horde-Horde-Support-2.0.3-1.el6 php-horde-Horde-Url-2.1.0-1.el6 vtk-5.8.0-6.el6.1 wordpress-3.5.1-1.el6 Details about builds: ================================================================================ drupal7-date_ical-2.3-1.el6 (FEDORA-EPEL-2013-0228) Allows creation of an iCal feed in Views -------------------------------------------------------------------------------- Update Information: Update to upstream 2.3 release Update to upstream 2.2 release -------------------------------------------------------------------------------- ChangeLog: -------------------------------------------------------------------------------- References: [ 1 ] Bug #904736 - drupal7-date_ical-2.3 is available https://bugzilla.redhat.com/show_bug.cgi?id=904736 [ 2 ] Bug #903583 - drupal7-date_ical-2.2 is available https://bugzilla.redhat.com/show_bug.cgi?id=903583 -------------------------------------------------------------------------------- ================================================================================ gdb-heap-0.5-9.1.el6 (FEDORA-EPEL-2012-6797) Extensions to gdb for debugging dynamic memory allocation -------------------------------------------------------------------------------- Update Information: gdb-heap built for EPEL 6 -------------------------------------------------------------------------------- References: [ 1 ] Bug #828169 - [RFE:EPEL] Request to add gdb-heap to EPEL https://bugzilla.redhat.com/show_bug.cgi?id=828169 -------------------------------------------------------------------------------- ================================================================================ guacd-0.7.0-3.el6 (FEDORA-EPEL-2013-0235) Proxy daemon for Guacamole -------------------------------------------------------------------------------- Update Information: Enable guacd user/group for daemon -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 30 2013 Simone Caronni <negativo17(a)gmail.com> - 0.7.0-3 - User creations is for all supported distributions. * Wed Jan 30 2013 Simone Caronni <negativo17(a)gmail.com> - 0.7.0-2 - Updated init script according to Fedora template. https://fedoraproject.org/wiki/Packaging:SysVInitScript?rd=Packaging/SysVIn… - Run daemon as guacd user/group. - Make sure $HOME is set before starting the daemon or the child crashes. -------------------------------------------------------------------------------- ================================================================================ jglobus-2.0.5-0.1.rc2.el6 (FEDORA-EPEL-2013-0231) Globus Java client libraries -------------------------------------------------------------------------------- Update Information: JGlobus version 2.0.5 release candidate 2. New packages jglobus-myproxy and jglobus-axisg -------------------------------------------------------------------------------- ChangeLog: * Tue Jan 29 2013 Mattias Ellert <mattias.ellert(a)fysast.uu.se> - 2.0.5-0.1.rc2 - 2.0.5 release candidate 2 - New jglobus-myproxy package - New jglobus-axisg package -------------------------------------------------------------------------------- ================================================================================ librcc-0.2.10-2.el6 (FEDORA-EPEL-2013-0234) RusXMMS Charset Conversion Library -------------------------------------------------------------------------------- Update Information: new version upstream -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 30 2013 Ivan Romanov <drizt(a)land.ru> - 0.2.10-2 - el6 hasn't gtk3 * Wed Jan 30 2013 Ivan Romanov <drizt(a)land.ru> - 0.2.10-1 - updated to 0.2.10 - dropped patches (applied by upstream) - new -gkt+ and -gtk3 subpackage -------------------------------------------------------------------------------- ================================================================================ ovirt-engine-sdk-3.2.0.8-1.el6 (FEDORA-EPEL-2013-0230) oVirt Engine Software Development Kit -------------------------------------------------------------------------------- Update Information: Update to upstream 3.2.0.8 -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 30 2013 Juan Hernandez <juan.hernandez(a)redhat.com> - 3.2.0.8-1 - Update to upstream 3.2.0.8 - Fix for #905359 -------------------------------------------------------------------------------- ================================================================================ php-horde-Horde-Cli-2.0.3-1.el6 (FEDORA-EPEL-2013-0238) Horde Command Line Interface API -------------------------------------------------------------------------------- Update Information: Horde_CLI 2.0.3: * [jan] Update French translation (Paul De Vlieger). Horde_Date 2.0.3: * [jan] Update French translation (Paul De Vlieger). * [jan] Fix error: DateTime::__construct(): Failed to parse time string (-001-11-01). * [jan] Catch DateTime exception in Horde_Date_Utils:daysInMonth() (Bug #11916). Horde_Support 2.0.3: * [mms] Fix detection of sys_getloadavg() on Windows (Bug #11972). Horde_Url 2.1.0: * [mms] Add Horde_Url_Data class. -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 30 2013 Remi Collet <remi(a)fedoraproject.org> - 2.0.3-1 - Update to 2.0.3 - fix files listed twice -------------------------------------------------------------------------------- ================================================================================ php-horde-Horde-Date-2.0.3-1.el6 (FEDORA-EPEL-2013-0238) Horde Date package -------------------------------------------------------------------------------- Update Information: Horde_CLI 2.0.3: * [jan] Update French translation (Paul De Vlieger). Horde_Date 2.0.3: * [jan] Update French translation (Paul De Vlieger). * [jan] Fix error: DateTime::__construct(): Failed to parse time string (-001-11-01). * [jan] Catch DateTime exception in Horde_Date_Utils:daysInMonth() (Bug #11916). Horde_Support 2.0.3: * [mms] Fix detection of sys_getloadavg() on Windows (Bug #11972). Horde_Url 2.1.0: * [mms] Add Horde_Url_Data class. -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 30 2013 Remi Collet <remi(a)fedoraproject.org> - 2.0.3-1 - Update to 2.0.3 - add option to run tests - install only locales from upstream list -------------------------------------------------------------------------------- ================================================================================ php-horde-Horde-Support-2.0.3-1.el6 (FEDORA-EPEL-2013-0238) Horde support package -------------------------------------------------------------------------------- Update Information: Horde_CLI 2.0.3: * [jan] Update French translation (Paul De Vlieger). Horde_Date 2.0.3: * [jan] Update French translation (Paul De Vlieger). * [jan] Fix error: DateTime::__construct(): Failed to parse time string (-001-11-01). * [jan] Catch DateTime exception in Horde_Date_Utils:daysInMonth() (Bug #11916). Horde_Support 2.0.3: * [mms] Fix detection of sys_getloadavg() on Windows (Bug #11972). Horde_Url 2.1.0: * [mms] Add Horde_Url_Data class. -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 30 2013 Remi Collet <remi(a)fedoraproject.org> - 2.0.3-1 - Update to 2.0.3 - add option to run tests -------------------------------------------------------------------------------- ================================================================================ php-horde-Horde-Url-2.1.0-1.el6 (FEDORA-EPEL-2013-0238) Horde Url class -------------------------------------------------------------------------------- Update Information: Horde_CLI 2.0.3: * [jan] Update French translation (Paul De Vlieger). Horde_Date 2.0.3: * [jan] Update French translation (Paul De Vlieger). * [jan] Fix error: DateTime::__construct(): Failed to parse time string (-001-11-01). * [jan] Catch DateTime exception in Horde_Date_Utils:daysInMonth() (Bug #11916). Horde_Support 2.0.3: * [mms] Fix detection of sys_getloadavg() on Windows (Bug #11972). Horde_Url 2.1.0: * [mms] Add Horde_Url_Data class. -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 30 2013 Remi Collet <remi(a)fedoraproject.org> - 2.1.0-1 - Update to 2.1.0 - add option to run tests -------------------------------------------------------------------------------- ================================================================================ vtk-5.8.0-6.el6.1 (FEDORA-EPEL-2013-0232) The Visualization Toolkit - A high level 3D visualization library -------------------------------------------------------------------------------- Update Information: Make vtk not require vtk-devel -------------------------------------------------------------------------------- ChangeLog: * Tue Jan 29 2013 Orion Poplawski <orion(a)cora.nwra.com> - 5.8.0-6.1 - Add patch to add soname to libvtkNetCDF_cxx -------------------------------------------------------------------------------- References: [ 1 ] Bug #905399 - vtk pulls in vtk-devel as a dependency https://bugzilla.redhat.com/show_bug.cgi?id=905399 -------------------------------------------------------------------------------- ================================================================================ wordpress-3.5.1-1.el6 (FEDORA-EPEL-2013-0233) Blog tool and publishing platform -------------------------------------------------------------------------------- Update Information: WordPress 3.5.1 is now available. Version 3.5.1 is the first maintenance release of 3.5, fixing 37 bugs. It is also a security release for all previous WordPress versions. Which include: * Editor: Prevent certain HTML elements from being unexpectedly removed or modified in rare cases. * Media: Fix a collection of minor workflow and compatibility issues in the new media manager. * Networks: Suggest proper rewrite rules when creating a new network. * Prevent scheduled posts from being stripped of certain HTML, such as video embeds, when they are published. * Work around some misconfigurations that may have caused some JavaScript in the WordPress admin area to fail. * Suppress some warnings that could occur when a plugin misused the database or user APIs. WordPress 3.5.1 also addresses the following security issues: * A server-side request forgery vulnerability and remote port scanning using pingbacks. This vulnerability, which could potentially be used to expose information and compromise a site, affects all previous WordPress versions. This was fixed by the WordPress security team. We’d like to thank security researchers Gennady Kovshenin and Ryan Dewhurst for reviewing our work. * Two instances of cross-site scripting via shortcodes and post content. These issues were discovered by Jon Cave of the WordPress security team. * A cross-site scripting vulnerability in the external library Plupload. Thanks to the Moxiecode team for working with us on this, and for releasing Plupload 1.5.5 to address this issue. -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 30 2013 Remi Collet <rcollet(a)redhat.com> - 3.5.1-1 - version 3.5.1, various bug and security fixes: CVE-2013-0235, CVE-2013-0236 and CVE-2013-0237 - drop -f option from rm to break build if upstream archive content change - protect akismet content (from upstream .htaccess) -------------------------------------------------------------------------------- References: [ 1 ] Bug #904120 - CVE-2013-0235 wordpress: Server-side request forgery and remote port scanning using pingbacks https://bugzilla.redhat.com/show_bug.cgi?id=904120 [ 2 ] Bug #904121 - wordpress: XSS flaws via shortcodes and HTTP POST content https://bugzilla.redhat.com/show_bug.cgi?id=904121 [ 3 ] Bug #904122 - wordpress: XSS in the external Plupload library https://bugzilla.redhat.com/show_bug.cgi?id=904122 --------------------------------------------------------------------------------

1 0

Fixed but buggy - Re: [CentOS] More on amavis/clam permission errors on Centos 6.3
by Robert Moskowitz 01 Feb '13

01 Feb '13

Posted on the Centos list originally. I believe this is a bug in the amavis package and maybe the clamav package. On 01/31/2013 07:05 AM, Ned Slider wrote: > On 31/01/13 11:17, Robert Moskowitz wrote: >> On 01/31/2013 02:30 AM, John Hinton wrote: >>> On 1/30/2013 5:05 PM, Robert Moskowitz wrote: >>>> On 01/30/2013 04:31 PM, Nicolas Thierry-Mieg wrote: >>>>> Robert Moskowitz wrote: >>>>>> I should probably find either the amavis or clam list(s) and take this >>>>>> there? >>>>>> >>>>> <snip> >>>>>> Oh, I have not applied the updated policy rpms that Dan Walsh pointed me >>>>>> to. This is all 'out of the box' rpms, following the amavis/clamav >>>>>> recommendations from: http://wiki.centos.org/HowTos/Amavisd >>>>> is it? so your rpms come from rpmforge? I thought you mentioned epel at >>>>> some point. Hopefully you're not mixing them? >>>> Sorry, I followed the HowTo, but got all the rpms from epel. >>>> >>>>> If you are, then that might be your problem. >>>>> If you really followed the wiki instructions you must be using RF >>>>> packages, so you could take it to the RF list. >>>>> And if you're using epel, then you didn't follow the wiki instructions >>>>> but nevertheless you should take it to the epel list... >>>> epel list. Hmm. Now to find that. >>>> >>>> Thanks for the direction. >>>> >>> Read near the top of the amavis config file. It will reference the >>> directories you are having trouble with. It tells you to create them and >>> that they need to be owned by whatever you set the amavis user to be. It >>> is all right there in the conf file. >>> >> Yes, I read that. >> >> >> amavis from the epel repo defaults to /var/spool/amavisd which is owned >> by amavis:amavis with permissions 700. >> >> The rpm created the subdirs under this of quarantine, tmp, and db also >> owned by amavis:amavis with permissions 700. I had to create var myself >> for spamassassin to use. >> >> The permissions problem is under /var/spool/amavis/tmp if you look at >> the maillog entry. I have altered all permissions to 750 and still have >> the problem; the directory created is with 700, and perhaps that is why >> the problem? >> > Permissions should be 750 as the clamav user is a member of the amavis > group and needs group access. So this is one bug for epel, as the rpm creates the directories with the wrong permissions. Either do it right, or leave to the installer. So I just changed all the amavis directories to 750 and restarted both amavisd and clamd and it worked this time! I thought I did the restart back before the rebuild, but maybe I didn't or I had other things configured wrong. So this IS a bug in the packaging for me to submit to epel. > >> I am thinking to change the clamd conf files to run with user amavis >> instead of clam and see if that gets around the problem... >> > That will likely cause other problems. The clamav user just needs to be > a member of the amavis group. That was my initial read, but as my frustration was rising, it looked like a way to troubleshoot the problem. So now I don't have to try this. > >> I have joined the epel-devel list (I did not find an epel-users list) >> and posted this there yesterday. I see that epel repo is the same >> version currently available from rpmforge that the howto uses. >> Interestingly, rpmforge uses userid clamav and epel uses userid clam. >> Don't know what other differences there are. So far no replies on the >> epel list. >> > As you have seen there are differences between the packages. This makes > the CentOS documentation worthless to you as you are not using the same > versions used in the documentation. I had hopes that the 'official' packaging would work well, particularly now that both are on the same release. I really wanted to do this all 'official' packages. I know there is nothing wrong with rpmforge, I use it for a number of things, just this time around for mail, I was shooting for 'fully supported cruft'. Shows how good that approach takes! > You should take this thread, and your issue, to the EPEL list as it > really has nothing to do with CentOS. Well I have and will post this there as well and submit the bug report. I have two on these packages so far. I started here as I did not know where best to take it (for example an amavis or clamav list?) but more becuase I was hoping that there would be Centos users that have worked with these packages and might be kind enough to share their insights. And thank you for your help.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

epel-devel February 2013