The following Fedora EPEL 6 Security updates need testing:

https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5620/bugzilla-3.4.1... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6374/rt3-3.8.13-1.e... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6330/perl-YAML-LibY... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6348/bcfg2-1.2.3-1.... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6408/ganglia-3.1.7-... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6358/openstack-nova... https://admin.fedoraproject.org/updates/FEDORA-EPEL-2011-4701/supybot-gribbl...

The following builds have been pushed to Fedora EPEL 6 updates-testing

fedmsg-0.2.5-1.el6 ganglia-3.1.7-6.el6 openstack-keystone-2012.1.1-1.el6 perl-ServiceNow-API-1.01-2.el6 python-django-horizon-2012.1.1-1.el6 zanata-python-client-1.3.8-1.el6

Details about builds:

================================================================================ fedmsg-0.2.5-1.el6 (FEDORA-EPEL-2012-6410) Tools for Fedora Infrastructure real-time messaging -------------------------------------------------------------------------------- Update Information:

0.2.5 with more realistic X509 capacity 0.2.4 with fix for disabled ssl 0.2.3 with upstream typo fixes Added deps on m2crypto and python-m2ext /var/log/fedmsg wasn't being created correctly. Require moksha >= 0.8.3. python-argparse fix for epel-6. -------------------------------------------------------------------------------- ChangeLog:

* Sun Jul 15 2012 Ralph Bean rbean@redhat.com - 0.2.5-1 - Upstream crypto updates in preparation for a more realistic X509 setup. * Fri Jul 13 2012 Ralph Bean rbean@redhat.com - 0.2.4-1 - Upstream bugfix for when ssl is disabled. * Wed Jul 11 2012 Ralph Bean rbean@redhat.com - 0.2.3-1 - Upstream bump that fixes some typos. * Tue Jul 10 2012 Ralph Bean rbean@redhat.com - 0.2.2-3 - Added deps on python-argparse for py < 2.7 (rhel6) * Sat Jul 7 2012 Ralph Bean rbean@redhat.com - 0.2.2-2 - Added deps on m2crypto and python-m2ext * Sat Jul 7 2012 Ralph Bean rbean@redhat.com - 0.2.2-1 - Update to fedmsg-irc to fix lineRate issues - fedmsg.crypto module - sign and validate messages * Mon Jun 11 2012 Ralph Bean rbean@redhat.com - 0.2.1-2 - Require moksha >= 0.8.3 * Mon Jun 11 2012 Ralph Bean rbean@redhat.com - 0.2.1-1 - Override producers and consumers entry-points in the hub. Should fix a collision that fedmsg-irc is having with fedoracommunity. * Mon Jun 11 2012 Ralph Bean rbean@redhat.com - 0.2.0-4 - Introduce temporary hard dep on orbited. * Mon Jun 11 2012 Ralph Bean rbean@redhat.com - 0.2.0-3 - /var/log/fedmsg wasn't being created correctly. --------------------------------------------------------------------------------

================================================================================ ganglia-3.1.7-6.el6 (FEDORA-EPEL-2012-6408) Ganglia Distributed Monitoring System -------------------------------------------------------------------------------- Update Information:

Fix for arbitrary PHP file execution -------------------------------------------------------------------------------- ChangeLog:

* Sun Jul 15 2012 Kostas Georgiou georgiou@fedoraproject.org - 3.1.7-6 - Backport of security patch for gangliabz#333 * Fri Jan 13 2012 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.1.7-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild * Tue Jun 14 2011 Kostas Georgiou georgiou@fedoraproject.org - 3.1.7-4 - Fix buffer overflow in moddisk.so #689483 -------------------------------------------------------------------------------- References:

[ 1 ] Bug #840318 - ganglia: Arbitrary PHP files may be executed from the Ganglia server due to unsanitized input to graph.php https://bugzilla.redhat.com/show_bug.cgi?id=840318 --------------------------------------------------------------------------------

================================================================================ openstack-keystone-2012.1.1-1.el6 (FEDORA-EPEL-2012-6413) OpenStack Identity Service -------------------------------------------------------------------------------- Update Information:

- update to stable essex release 2012.1.1 * Sync up with Essex stable branch * Split auth_token middleware to python-keystone-auth-token subpackage -------------------------------------------------------------------------------- ChangeLog:

* Fri Jun 22 2012 Alan Pevec apevec@redhat.com 2012.1.1-1 - updated to stable essex release 2012.1.1 * Thu Jun 21 2012 Alan Pevec apevec@redhat.com 2012.1-9 - add upstart job, alternative to sysv initscript * Fri Jun 15 2012 Alan Pevec apevec@redhat.com 2012.1-8 - fix upgrade case with python-keystone-auth-token (rhbz#824034#c20) * Mon Jun 11 2012 Alan Pevec apevec@redhat.com 2012.1-7 - Corrects url conversion in export_legacy_catalog (lp#994936) - Invalidate user tokens when password is changed (lp#996595) - Invalidate user tokens when a user is disabled (lp#997194) - Carrying over token expiry time when token chaining (lp#998185) * Tue May 29 2012 Alan Pevec apevec@redhat.com 2012.1-6 - python-keystone-auth-token subpackage (rhbz#824034) - use reserved user id for keystone (rhbz#752842) - fix paste.deploy dependency (rhbz#826120) * Mon May 21 2012 Alan Pevec apevec@redhat.com 2012.1-5 - Sync up with Essex stable branch - Remove dependencies no loner needed by Essex * Tue May 1 2012 Pádraig Brady P@draigBrady.com 2012.1-4 - Start the services later in the boot sequence -------------------------------------------------------------------------------- References:

[ 1 ] Bug #824034 - auth_token middleware should be in its own subpackage https://bugzilla.redhat.com/show_bug.cgi?id=824034 [ 2 ] Bug #826120 - keystone service fails to start on a clean install https://bugzilla.redhat.com/show_bug.cgi?id=826120 [ 3 ] Bug #828794 - Once a token is created/distributed its expiry date can be circumvented https://bugzilla.redhat.com/show_bug.cgi?id=828794 [ 4 ] Bug #824945 - Tokens remain valid after a user account is disabled https://bugzilla.redhat.com/show_bug.cgi?id=824945 [ 5 ] Bug #824939 - Following a password compromise and subsequent password change, tokens remain valid. https://bugzilla.redhat.com/show_bug.cgi?id=824939 --------------------------------------------------------------------------------

================================================================================ perl-ServiceNow-API-1.01-2.el6 (FEDORA-EPEL-2012-6409) ServiceNow API for accessing the Service-now platform -------------------------------------------------------------------------------- Update Information:

ServiceNow API for accessing the Service-now platform -------------------------------------------------------------------------------- References:

[ 1 ] Bug #838621 - Review Request: perl-ServiceNow-API - ServiceNow API for accessing the Service-now platform https://bugzilla.redhat.com/show_bug.cgi?id=838621 --------------------------------------------------------------------------------

================================================================================ python-django-horizon-2012.1.1-1.el6 (FEDORA-EPEL-2012-6412) Django application for talking to Openstack -------------------------------------------------------------------------------- Update Information:

- Update to essex stable release 2012.1.1 -------------------------------------------------------------------------------- ChangeLog:

* Fri Jul 6 2012 Nuno Santos nsantos@redhat.com - 2012.1.1-1 - Update to essex stable release 2012.1.1 * Wed May 9 2012 Alan Pevec apevec@redhat.com - 2012.1-6 - Remove the currently uneeded dependency on python-django-nose --------------------------------------------------------------------------------

================================================================================ zanata-python-client-1.3.8-1.el6 (FEDORA-EPEL-2012-6414) Python Client for Zanata Server -------------------------------------------------------------------------------- Update Information:

- Fix issue of po/publican push and po/publican pull command for project_type - Fixed rhbz826821, glossary-push failed on big compendium po file - Add link of trouble shooting page to error message - Fix bypass ssl certificate check issue - Fixed rhbz831944, "Delete" message is unclear

- Fixed rhbz#827316, failed to push pot with msgid_plural against 1.6 server - Fixed rhbz#826798, zanata pull fail to pull - Fixed rhbz#814593, "TypeError: 'unicode' object does not support item assignment" when pulling translation from server - Fixed rhbz#820046, Python client generates empty msgctxt "" when pushing - Fixed rhbz#795643, Python client pushes extracted comments instead of translator comments - Fix the query param of skeletons - Add option --disable-ssl-cert to python client- - Add help message for noskeletons option in pull, change content of Error 403 - Fixed the query param of skeletons - Implment --push-type option, omit --push-trans when specify --push-type option - Implement glossary delete command - Refactoring code and remove duplicate code

- Fixed rhbz#827316, failed to push pot with msgid_plural against 1.6 server - Fixed rhbz#826798, zanata pull fail to pull - Fixed rhbz#814593, "TypeError: 'unicode' object does not support item assignment" when pulling translation from server - Fixed rhbz#820046, Python client generates empty msgctxt "" when pushing - Fixed rhbz#795643, Python client pushes extracted comments instead of translator comments - Fix the query param of skeletons - Add option --disable-ssl-cert to python client- - Add help message for noskeletons option in pull, change content of Error 403 - Fixed the query param of skeletons - Implment --push-type option, omit --push-trans when specify --push-type option - Implement glossary delete command - Refactoring code and remove duplicate code

- Fixed rhbz#827316, failed to push pot with msgid_plural against 1.6 server - Fixed rhbz#826798, zanata pull fail to pull - Fixed rhbz#814593, "TypeError: 'unicode' object does not support item assignment" when pulling translation from server - Fixed rhbz#820046, Python client generates empty msgctxt "" when pushing - Fixed rhbz#795643, Python client pushes extracted comments instead of translator comments - Fix the query param of skeletons - Add option --disable-ssl-cert to python client- - Add help message for noskeletons option in pull, change content of Error 403 - Fixed the query param of skeletons - Implment --push-type option, omit --push-trans when specify --push-type option - Implement glossary delete command - Refactoring code and remove duplicate code

-------------------------------------------------------------------------------- ChangeLog:

* Mon Jul 16 2012 James Ni jni@redhat.com - 1.3.8-1 - Fix issue of po/publican push and po/publican pull command for project_type - Fixed rhbz826821, glossary-push failed on big compendium po file - Add link of trouble shooting page to error message - Fix bypass ssl certificate check issue - Change Delete to Deleting * Wed Jun 13 2012 James Ni jni@redhat.com - 1.3.7-1 - Fixed rhbz#827316, failed to push pot with msgid_plural against 1.6 server - Fixed rhbz#826798, zanata pull fail to pull - Fixed rhbz#814593, "TypeError: 'unicode' object does not support item assignment" when pulling translation from server - Fixed rhbz#820046, Python client generates empty msgctxt "" when pushing - Fixed rhbz#795643, Python client pushes extracted comments instead of translator comments - Fix the query param of skeletons - Add option --disable-ssl-cert to python client - Add help message for noskeletons option in pull, change content of Error 403 - Fixed the query param of skeletons - Implment --push-type option, omit --push-trans when specify --push-type option - Implement glossary delete command - Refactoring code and remove duplicate code -------------------------------------------------------------------------------- References:

[ 1 ] Bug #826821 - [zanata-python-client] glossary-push failed on big compendium po file https://bugzilla.redhat.com/show_bug.cgi?id=826821 --------------------------------------------------------------------------------