The following Fedora EPEL 5 Security updates need testing:
Age URL
500
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5630/bugzilla-3....
395
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6608/Django-1.1....
15
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11276/ssmtp-2.61...
13
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11300/drupal7-th...
9
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11336/lighttpd-1...
3
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11396/cacti-0.8....
1
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11418/graphite-w...
0
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11448/perl-Crypt...
The following builds have been pushed to Fedora EPEL 5 updates-testing
perl-Crypt-DSA-0.14-8.el5
rubygem-rest-client-1.6.7-1.el5
Details about builds:
================================================================================
perl-Crypt-DSA-0.14-8.el5 (FEDORA-EPEL-2013-11448)
Perl module for DSA signatures and key generation
--------------------------------------------------------------------------------
Update Information:
As taught by the '09 Debian PGP disaster relating to DSA, the randomness source is
extremely important. On systems without /dev/random, Crypt::DSA falls back to using
Data::Random. Data::Random uses rand(), about which the perldoc says "rand() is not
cryptographically secure. You should not rely on it in security-sensitive
situations." In the case of DSA, this is even worse. Using improperly secure
randomness sources can compromise the signing key upon signature of a message.
See:
http://rdist.root.org/2010/11/19/dsa-requirements-for-random-k-value/
It might seem that this would not affect Linux since /dev/random is always available and
so the fall back to Data::Random would never happen. However, if an application is
confined using a MAC system such as SELinux then access to /dev/random could be denied by
policy and the fall back would be triggered.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #743567 - CVE-2011-3599 perl-Crypt-DSA: Cryptographically insecure method used
for random numbers generation on systems without /dev/random
https://bugzilla.redhat.com/show_bug.cgi?id=743567
--------------------------------------------------------------------------------
================================================================================
rubygem-rest-client-1.6.7-1.el5 (FEDORA-EPEL-2013-11450)
Simple REST client for Ruby
--------------------------------------------------------------------------------
Update Information:
Version 1.6.7
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 4 2013 Michal Fojtik <mfojtik(a)redhat.com> - 1.6.7-1
- Update to 1.6.7
* Mon Mar 21 2011 Michal Fojtik <mfojtik(a)redhat.com> - 1.4.0-7
- Reverted to old version
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #672213 - request to upgrade package version
https://bugzilla.redhat.com/show_bug.cgi?id=672213
--------------------------------------------------------------------------------