To whom it may concern,
Okay I¹m currently maintaining the torque package that is currently at an
impasse for moving forward.
https://bugzilla.redhat.com/show_bug.cgi?id=1328958 (desire from upstream
to upgrade to v6.0.1)
https://bugzilla.redhat.com/show_bug.cgi?id=1321154
<https://bugzilla.redhat.com/show_bug.cgi?id=1321154>=1321154> (desire to
downgrade v4.2.10 to remove numa support and or fork package)
https://bugzilla.redhat.com/show_bug.cgi?id=1231148 (desire to have numa
support enabled)
So as I read the https://fedoraproject.org/wiki/EPEL/GuidelinesAndPolicies
about updates in EPEL the way to close these two bugs is to downgrade the
torque package to the version without numa support. The assumption for the
user who wants to run torque v6.0.1 is to install Fedora where these
versions can change every 18 months and they¹ll get the version and fix
they need. For most major parts of the Fedora/RHEL pipeline this works
fine, kernel, Xorg, gnome, etc. However, I¹d like to propose an
alternative for EPEL since the goal of the software developers is not to
target Fedora but RHEL directly.
The normal package lifecycle for Fedora/EPEL developers starts when the
packager decides to cut a Œstable¹ release of his new code and wants it
distributed. We take that code and package it for Fedora, since that¹s
what the developer targeted his new release for. The software is more than
likely targeted for Fedora as that distribution contains the latest
versions of all the OSS out there. The package may experience a
branch/fork (whatever you want to call it) to EPEL when a new release of
RHEL is created and when the need for it gets expressed.
The version of that package in EPEL will remain fixed for several reasons.
First is that the dependent packages are usually managed by RedHat and are
fixed, so API compatibility issues quickly come into play when updating a
package who¹s developers are targeting Fedora as their development
environment. Second, is the Guidelines and Polices mentioned in the EPEL
Fedora Wiki. People want stability when they are using an OS that¹s
managed like a stable OS and we can¹t have instability in EPEL as it looks
bad on the RedHat OS which gets really problematicŠ
Identifying the gap for the Torque package specifically (and probably
others) is that the developers for the package are targeting enterprise
Linux distributions for their development environments. Within the HPC
community we support scientific codes that are very sensitive to changes
in the OS and we have to run enterprise linux distributions on our
clusters to make the applications work. Hence, most of the software that
is specific to HPC environments is built and developed on RHEL (for our
purposes anyway, we don¹t care about those SLES people).
This presents a problem, I¹ve got three major versions of Torque that are
supported by the developers and all of them were built and developed for
RHEL and should be included in EPEL. However, I¹ve only got one spec and
one version of Torque I can support for EPEL and its fixed for all time. I
would very much like to have a solution that will work for all of my
users. I¹d also like to have a solution for users to move forward in major
versions of torque when they are ready without having to compromise
stability within that major version of torque.
Some of the solutions I¹ve thought of are the following:
* Have three forks of torque in EPEL; stable, feature and unstable
* stable is the cut of torque when that major version of RHEL was
released and only changes if there¹s security issues
* feature updates from unstable only in very specific situations
* minor release of RHEL comes out and that major release hasn¹t gotten
into LTS security patches only mode from RedHat.
* unstable updates with whatever the upstream has for new code whenever
they release it (treated like Fedora Package)
If other¹s have this issue and would like to see these their package split
like this please feel free to speak up. This seems like a gap that we can
fix though it would be nice to know how to move forward with this.
If what I¹m suggesting isn¹t possible I¹m perfectly willing to hand over
management of the torque package to someone else.
Thanks,
- David Brown
The following Fedora EPEL 7 Security updates need testing:
Age URL
463 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-1087 dokuwiki-0-0.24.20140929c.el7
225 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-dac7ed832f mcollective-2.8.4-1.el7
92 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-785fc9a2ea dropbear-2016.72-1.el7
12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-804b7430fd GraphicsMagick-1.3.24-1.el7
12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-70e05c7285 nginx-1.6.3-9.el7
4 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-153f7ebdb7 iperf3-3.1.3-1.el7
1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-ac8f9cc0fd nfdump-1.6.15-1.el7
1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-86f7c45855 php-zendframework-zendxml-1.0.2-2.el7 php-ZendFramework2-2.4.10-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
copr-cli-1.51-1.el7
mozilla-fira-fonts-4.202-1.el7
php-goutte-2.0.4-1.el7
sks-1.1.5-99.403hg.el7
Details about builds:
================================================================================
copr-cli-1.51-1.el7 (FEDORA-EPEL-2016-14af9b043f)
Command line interface for COPR
--------------------------------------------------------------------------------
Update Information:
Support for package manipulation as a main new feature.
--------------------------------------------------------------------------------
================================================================================
mozilla-fira-fonts-4.202-1.el7 (FEDORA-EPEL-2016-665431e0ae)
Mozilla's Fira fonts
--------------------------------------------------------------------------------
Update Information:
Update to the latest upstream (among other things fixes problems with bad
hinting).
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1273554 - Too high mono font; please, upgrade to the latest upstream
https://bugzilla.redhat.com/show_bug.cgi?id=1273554
--------------------------------------------------------------------------------
================================================================================
php-goutte-2.0.4-1.el7 (FEDORA-EPEL-2016-9a92e77f27)
A simple PHP web scraper
--------------------------------------------------------------------------------
Update Information:
Updated to version 2.
https://github.com/FriendsOfPHP/Goutte/compare/v1.0.7...v2.0.4
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1100719 - php-goutte-v3.1.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1100719
[ 2 ] Bug #1289798 - php-goutte-3.1.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1289798
--------------------------------------------------------------------------------
================================================================================
sks-1.1.5-99.403hg.el7 (FEDORA-EPEL-2016-c5f5baabd6)
Synchronizing Key Server
--------------------------------------------------------------------------------
Update Information:
Update to latest sks from mercurial
--------------------------------------------------------------------------------
The following Fedora EPEL 6 Security updates need testing:
Age URL
359 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-6828 chicken-4.9.0.1-4.el6
341 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-7031 python-virtualenv-12.0.7-1.el6
335 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-7168 rubygem-crack-0.3.2-2.el6
266 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-8156 nagios-4.0.8-1.el6
225 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-e2b4b5b2fb mcollective-2.8.4-1.el6
197 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-35e240edd9 thttpd-2.25b-24.el6
90 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-8fbd838843 dropbear-2016.72-1.el6
83 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-30a8346813 vtun-3.0.1-10.el6
12 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-c5dae2a582 GraphicsMagick-1.3.24-1.el6
7 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-314ade996d phpMyAdmin-4.0.10.15-2.el6
3 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-52cc1f9c07 iperf3-3.0.12-1.el6
1 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-7640e3144a proftpd-1.3.3g-10.el6
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-42cb1b4ac8 php-ZendFramework2-2.2.10-1.el6 php-zendframework-zendxml-1.0.2-2.el6
The following builds have been pushed to Fedora EPEL 6 updates-testing
copr-cli-1.51-1.el6
dibbler-1.0.1-3.el6
php-ZendFramework2-2.2.10-1.el6
php-zendframework-zendxml-1.0.2-2.el6
Details about builds:
================================================================================
copr-cli-1.51-1.el6 (FEDORA-EPEL-2016-29927f4d99)
Command line interface for COPR
--------------------------------------------------------------------------------
Update Information:
Support for package manipulation as a main new feature.
--------------------------------------------------------------------------------
================================================================================
dibbler-1.0.1-3.el6 (FEDORA-EPEL-2016-2864119c48)
Portable DHCPv6 implementation
--------------------------------------------------------------------------------
Update Information:
This is the initial version of the dibbler package for EPEL6.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1325681 - Build for EL6 in EPEL?
https://bugzilla.redhat.com/show_bug.cgi?id=1325681
--------------------------------------------------------------------------------
================================================================================
php-ZendFramework2-2.2.10-1.el6 (FEDORA-EPEL-2016-42cb1b4ac8)
Zend Framework 2
--------------------------------------------------------------------------------
Update Information:
## 2.2.10 (2015-02-18) ### SECURITY UPDATES - **ZF2015-02:**
`Zend\Db\Adapter\Platform\Postgresql` was incorrectly using `\\` to escape
double quotes in identifiers and values, which could lead to SQL injection
vectors. We have provided patches that use proper escaping. If you use
Postgresql with Zend Framework 2, we recommend upgrading immediately. ## 2.2.9
(2015-01-14) ### SECURITY UPDATES - **ZF2015-01:** Session validators were not
run if set before session start. Essentially, the validators were writing to
the `$_SESSION` superglobal before session start, which meant the data was
overwritten once the session began. This meant on subsequent calls, the
validators had no data to compare against, making the sessions automatically
valid. We have provided patches to ensure that validators are run only after
the session has begun, which will ensure they validate sessions correctly
going forward. If you use `Zend\Session` validators, we recommend upgrading
immediately.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1343989 - [epel6][security] php-ZendFramework2-2.2.10 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1343989
--------------------------------------------------------------------------------
================================================================================
php-zendframework-zendxml-1.0.2-2.el6 (FEDORA-EPEL-2016-42cb1b4ac8)
Zend Framework ZendXml component
--------------------------------------------------------------------------------
Update Information:
## 2.2.10 (2015-02-18) ### SECURITY UPDATES - **ZF2015-02:**
`Zend\Db\Adapter\Platform\Postgresql` was incorrectly using `\\` to escape
double quotes in identifiers and values, which could lead to SQL injection
vectors. We have provided patches that use proper escaping. If you use
Postgresql with Zend Framework 2, we recommend upgrading immediately. ## 2.2.9
(2015-01-14) ### SECURITY UPDATES - **ZF2015-01:** Session validators were not
run if set before session start. Essentially, the validators were writing to
the `$_SESSION` superglobal before session start, which meant the data was
overwritten once the session began. This meant on subsequent calls, the
validators had no data to compare against, making the sessions automatically
valid. We have provided patches to ensure that validators are run only after
the session has begun, which will ensure they validate sessions correctly
going forward. If you use `Zend\Session` validators, we recommend upgrading
immediately.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1343989 - [epel6][security] php-ZendFramework2-2.2.10 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1343989
--------------------------------------------------------------------------------
Dear R package developers,
Since the upgrade from R 3.2.x to 3.3.0 I was confronted with several problems updating/installing some R packages.
Here for instance:
# R
R version 3.3.0 (2016-05-03) -- "Supposedly Educational"
Copyright (C) 2016 The R Foundation for Statistical Computing
Platform: x86_64-redhat-linux-gnu (64-bit)
> install.packages("slam")
Installing package into ‘/usr/lib64/R/library’
(as ‘lib’ is unspecified)
trying URL 'https://cran.uni-muenster.de/src/contrib/slam_0.1-34.tar.gz'
Content type 'application/x-gzip' length 46766 bytes (45 KB)
==================================================
downloaded 45 KB
* installing *source* package ‘slam’ ...
** package ‘slam’ successfully unpacked and MD5 sums checked
** libs
...
gcc -m64 -std=gnu99 -shared -L/usr/lib64/R/lib -o slam.so apply.o grouped.o sparse.o util.o -L/usr/lib64/R/lib -lRblas -ldl -lpthread -lrt /builddir/build/BUILD/R-3.3.0/zlib-1.2.8/target/usr/lib64/libz.a /builddir/build/BUILD/R-3.3.0/bzip2-1.0.6/target/usr/lib64/libbz2.a /builddir/build/BUILD/R-3.3.0/xz-5.2.2/target/usr/lib64/liblzma.a /builddir/build/BUILD/R-3.3.0/pcre-8.38/target/usr/lib64/libpcre.a /builddir/build/BUILD/R-3.3.0/curl-7.48.0/target/usr/lib64/libcurl.a -lcurl -lidn -lssh2 -lssl -lcrypto -lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -lldap -lz -lgfortran -lm -L/usr/lib64/R/lib -lR
gcc: /builddir/build/BUILD/R-3.3.0/zlib-1.2.8/target/usr/lib64/libz.a: No such file or directory
gcc: /builddir/build/BUILD/R-3.3.0/bzip2-1.0.6/target/usr/lib64/libbz2.a: No such file or directory
gcc: /builddir/build/BUILD/R-3.3.0/xz-5.2.2/target/usr/lib64/liblzma.a: No such file or directory
gcc: /builddir/build/BUILD/R-3.3.0/pcre-8.38/target/usr/lib64/libpcre.a: No such file or directory
gcc: /builddir/build/BUILD/R-3.3.0/curl-7.48.0/target/usr/lib64/libcurl.a: No such file or directory
make: *** [slam.so] Error 1
ERROR: compilation failed for package ‘slam’
...
The same errors occur if I try to install other packages. It seems as newer libraries are needed as CentOS 6 can provide. My kernel version is 2.6.32-642.1.1.el6.x86_64. My R-core version is 3.3.0-5.el6.
Could somebody give me a hint how to solve this issue?
Thx, Martin
The following Fedora EPEL 7 Security updates need testing:
Age URL
462 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-1087 dokuwiki-0-0.24.20140929c.el7
224 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-dac7ed832f mcollective-2.8.4-1.el7
90 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-785fc9a2ea dropbear-2016.72-1.el7
11 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-804b7430fd GraphicsMagick-1.3.24-1.el7
11 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-70e05c7285 nginx-1.6.3-9.el7
2 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-153f7ebdb7 iperf3-3.1.3-1.el7
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-ac8f9cc0fd nfdump-1.6.15-1.el7
0 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-86f7c45855 php-zendframework-zendxml-1.0.2-2.el7 php-ZendFramework2-2.4.10-1.el7
The following builds have been pushed to Fedora EPEL 7 updates-testing
czmq-3.0.2-3.el7
libnftnl-1.0.6-1.el7
limnoria-20160506-2.el7
mxml-2.9-1.el7
nfdump-1.6.15-1.el7
nftables-0.6-1.el7
nitroshare-0.3.1-3.20160612git930c9b7.el7
php-ZendFramework2-2.4.10-1.el7
php-libvirt-0.5.2-1.el7
php-zendframework-zendxml-1.0.2-2.el7
python-pysocks-1.5.6-3.el7
supybot-notify-0.2.2-9.el7
zeromq-4.1.4-5.el7
Details about builds:
================================================================================
czmq-3.0.2-3.el7 (FEDORA-EPEL-2016-611247d1a6)
High-level C binding for 0MQ (ZeroMQ)
--------------------------------------------------------------------------------
Update Information:
Upgrade for EPEL7
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1302118 - Please update czmq to version 3.0.2
https://bugzilla.redhat.com/show_bug.cgi?id=1302118
--------------------------------------------------------------------------------
================================================================================
libnftnl-1.0.6-1.el7 (FEDORA-EPEL-2016-dd3c42b375)
Library for low-level interaction with nftables Netlink's API over libmnl
--------------------------------------------------------------------------------
Update Information:
Initial version of nftables and deps for epel7
--------------------------------------------------------------------------------
================================================================================
limnoria-20160506-2.el7 (FEDORA-EPEL-2016-e7cc57a690)
A modified version of Supybot (an IRC bot) with enhancements and bug fixes
--------------------------------------------------------------------------------
Update Information:
initial version of limnoria to replace supybot-gribble.
--------------------------------------------------------------------------------
================================================================================
mxml-2.9-1.el7 (FEDORA-EPEL-2016-dd3c42b375)
Miniature XML development library
--------------------------------------------------------------------------------
Update Information:
Initial version of nftables and deps for epel7
--------------------------------------------------------------------------------
================================================================================
nfdump-1.6.15-1.el7 (FEDORA-EPEL-2016-ac8f9cc0fd)
NetFlow collecting and processing tools
--------------------------------------------------------------------------------
Update Information:
nfdump 1.6.15 released. --- - Fix Security issue http://www.security-assessmen
t.com/files/documents/advisory/Nfdump%20nfcapd%201.6.14%20-%20Multiple%20Vulnera
bilities.pdf - Fix obyte, opps and obps output records - Fix wrong bps type case
in cvs output. Fix opbs ipbs typos nfdump 1.6.14 released. --- - Create
libnfdump for dynamic linking - Add -R to ModifyCompression - Add std sampler ID
4 Bytes and allow random sampler (tag 50) - Add BZ2 compression along existing
LZ0 - Add direct write to flowtools converter ft2nfdump - Fix CentOS compile
issues with flow-tools converter - Fix FreeBSD,OpenBSD build problems - Fix
timestamp overflow in sflow.c - Fix IP Fragmentation in sflow collector - Fix
compile errors on other platforms - Fix zero alignment bug, if only half of an
extension is sent - Fix nfanon time window bug in subsequent files in -R list -
Fix CommonRecordV0Type conversion bug - Fix nfexport bug, if only one single map
exists
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1335204 - nfdump: multiple remote denial of service vulnerabilities
https://bugzilla.redhat.com/show_bug.cgi?id=1335204
--------------------------------------------------------------------------------
================================================================================
nftables-0.6-1.el7 (FEDORA-EPEL-2016-dd3c42b375)
Netfilter Tables userspace utillites
--------------------------------------------------------------------------------
Update Information:
Initial version of nftables and deps for epel7
--------------------------------------------------------------------------------
================================================================================
nitroshare-0.3.1-3.20160612git930c9b7.el7 (FEDORA-EPEL-2016-c812458f3c)
Transfer files from one device to another made extremely simple
--------------------------------------------------------------------------------
Update Information:
initial package, rhbz#1338553 - use git snapshot with several bugfixes - add
Qt5Svg as dependency ---- initial package, rhzb#1338553
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1338553 - Review Request: nitroshare - Transfer files from one device to another made extremely simple
https://bugzilla.redhat.com/show_bug.cgi?id=1338553
--------------------------------------------------------------------------------
================================================================================
php-ZendFramework2-2.4.10-1.el7 (FEDORA-EPEL-2016-86f7c45855)
Zend Framework 2
--------------------------------------------------------------------------------
Update Information:
## 2.4.10 (2016-05-09) - Fix HeaderValue throwing an exception on legal
characters ## 2.4.9 (2015-11-23) ### SECURITY UPDATES - **ZF2015-09**:
`Zend\Captcha\Word` generates a "word" for a CAPTCHA challenge by selecting a
sequence of random letters from a character set. Prior to this vulnerability
announcement, the selection was performed using PHP's internal `array_rand()`
function. This function does not generate sufficient entropy due to its usage
of `rand()` instead of more cryptographically secure methods such as
`openssl_pseudo_random_bytes()`. This could potentially lead to information
disclosure should an attacker be able to brute force the random number
generation. This release contains a patch that replaces the `array_rand()`
calls to use `Zend\Math\Rand::getInteger()`, which provides better RNG. -
**ZF2015-10**: `Zend\Crypt\PublicKey\Rsa\PublicKey` has a call to
`openssl_public_encrypt()` which used PHP's default `$padding` argument, which
specifies `OPENSSL_PKCS1_PADDING`, indicating usage of PKCS1v1.5 padding. This
padding has a known vulnerability, the [Bleichenbacher's chosen-ciphertext
attack](http://crypto.stackexchange.com/questions/12688/can-you-explain-
bleichenbachers-cca-attack-on-pkcs1-v1-5), which can be used to recover an RSA
private key. This release contains a patch that changes the padding argument
to use `OPENSSL_PKCS1_OAEP_PADDING`. Users upgrading to this version may have
issues decrypting previously stored values, due to the change in padding. If
this occurs, you can pass the constant `OPENSSL_PKCS1_PADDING` to a new
`$padding` argument in `Zend\Crypt\PublicKey\Rsa::encrypt()` and `decrypt()`
(though typically this should only apply to the latter): ```php
$decrypted = $rsa->decrypt($data, $key, $mode, OPENSSL_PKCS1_PADDING); ```
where `$rsa` is an instance of `Zend\Crypt\PublicKey\Rsa`. (The `$key` and
`$mode` argument defaults are `null` and
`Zend\Crypt\PublicKey\Rsa::MODE_AUTO`, if you were not using them previously.)
We recommend re-encrypting any such values using the new defaults.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1343990 - [epel7][security] php-ZendFramework2-2.4.10 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1343990
[ 2 ] Bug #1289318 - CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1289318
[ 3 ] Bug #1343995 - [f23][f22][security] php-ZendFramework2-2.4.10 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1343995
[ 4 ] Bug #1289317 - CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1289317
--------------------------------------------------------------------------------
================================================================================
php-libvirt-0.5.2-1.el7 (FEDORA-EPEL-2016-22d8e14cdd)
PHP language bindings for Libvirt
--------------------------------------------------------------------------------
Update Information:
Upgrade to 0.5.2 to support newer libvirt capabilities
--------------------------------------------------------------------------------
================================================================================
php-zendframework-zendxml-1.0.2-2.el7 (FEDORA-EPEL-2016-86f7c45855)
Zend Framework ZendXml component
--------------------------------------------------------------------------------
Update Information:
## 2.4.10 (2016-05-09) - Fix HeaderValue throwing an exception on legal
characters ## 2.4.9 (2015-11-23) ### SECURITY UPDATES - **ZF2015-09**:
`Zend\Captcha\Word` generates a "word" for a CAPTCHA challenge by selecting a
sequence of random letters from a character set. Prior to this vulnerability
announcement, the selection was performed using PHP's internal `array_rand()`
function. This function does not generate sufficient entropy due to its usage
of `rand()` instead of more cryptographically secure methods such as
`openssl_pseudo_random_bytes()`. This could potentially lead to information
disclosure should an attacker be able to brute force the random number
generation. This release contains a patch that replaces the `array_rand()`
calls to use `Zend\Math\Rand::getInteger()`, which provides better RNG. -
**ZF2015-10**: `Zend\Crypt\PublicKey\Rsa\PublicKey` has a call to
`openssl_public_encrypt()` which used PHP's default `$padding` argument, which
specifies `OPENSSL_PKCS1_PADDING`, indicating usage of PKCS1v1.5 padding. This
padding has a known vulnerability, the [Bleichenbacher's chosen-ciphertext
attack](http://crypto.stackexchange.com/questions/12688/can-you-explain-
bleichenbachers-cca-attack-on-pkcs1-v1-5), which can be used to recover an RSA
private key. This release contains a patch that changes the padding argument
to use `OPENSSL_PKCS1_OAEP_PADDING`. Users upgrading to this version may have
issues decrypting previously stored values, due to the change in padding. If
this occurs, you can pass the constant `OPENSSL_PKCS1_PADDING` to a new
`$padding` argument in `Zend\Crypt\PublicKey\Rsa::encrypt()` and `decrypt()`
(though typically this should only apply to the latter): ```php
$decrypted = $rsa->decrypt($data, $key, $mode, OPENSSL_PKCS1_PADDING); ```
where `$rsa` is an instance of `Zend\Crypt\PublicKey\Rsa`. (The `$key` and
`$mode` argument defaults are `null` and
`Zend\Crypt\PublicKey\Rsa::MODE_AUTO`, if you were not using them previously.)
We recommend re-encrypting any such values using the new defaults.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1343990 - [epel7][security] php-ZendFramework2-2.4.10 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1343990
[ 2 ] Bug #1289318 - CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1289318
[ 3 ] Bug #1343995 - [f23][f22][security] php-ZendFramework2-2.4.10 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1343995
[ 4 ] Bug #1289317 - CVE-2015-7503 php-ZendFramework2: Usage of vulnerable PKCS#1 v1.5 padding allows to recover RSA private key [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1289317
--------------------------------------------------------------------------------
================================================================================
python-pysocks-1.5.6-3.el7 (FEDORA-EPEL-2016-e7cc57a690)
A Python SOCKS client module
--------------------------------------------------------------------------------
Update Information:
initial version of limnoria to replace supybot-gribble.
--------------------------------------------------------------------------------
================================================================================
supybot-notify-0.2.2-9.el7 (FEDORA-EPEL-2016-e7cc57a690)
Notification plugin for Supybot
--------------------------------------------------------------------------------
Update Information:
initial version of limnoria to replace supybot-gribble.
--------------------------------------------------------------------------------
================================================================================
zeromq-4.1.4-5.el7 (FEDORA-EPEL-2016-9769421234)
Software library for fast, message-based applications
--------------------------------------------------------------------------------
Update Information:
Upgrade for EPEL 7
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1301163 - zeromq-4.1.4 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1301163
--------------------------------------------------------------------------------