[SECURITY] Fedora EPEL 6 Update: csync2-1.34-15.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-1108
2015-03-08 20:52:13
--------------------------------------------------------------------------------
Name : csync2
Product : Fedora EPEL 6
Version : 1.34
Release : 15.el6
URL : http://oss.linbit.com/csync2/
Summary : Cluster synchronization tool
Description :
Csync2 is a cluster synchronization tool. It can be used to keep files on
multiple hosts in a cluster in sync. Csync2 can handle complex setups with
much more than just 2 hosts, handle file deletions and can detect conflicts.
It is expedient for HA-clusters, HPC-clusters, COWs and server farms.
--------------------------------------------------------------------------------
Update Information:
Changes in librsync 1.0.0 (2015-01-23)
======================================
* SECURITY: CVE-2014-8242: librsync previously used a truncated MD4 "strong" check sum to match blocks. However, MD4 is not cryptographically strong. It's possible that an attacker who can control the contents of one part of a file could use it to control other regions of the file, if it's transferred using librsync/rdiff. For example this might occur in a database, mailbox, or VM image containing some attacker-controlled data. To mitigate this issue, signatures will by default be computed with a 256-bit BLAKE2 hash. Old versions of librsync will complain about a bad magic number when given these signature files. Backward compatibility can be obtained using the new `rdiff sig --hash=md4` option or through specifying the "signature magic" in the API, but this should not be used when either the old or new file contain untrusted data. Deltas generated from those signatures will also use BLAKE2 during generation, but produce output that can be read by old versions. See https://github.com/librsync/librsync/issues/5. Thanks to Michael Samuel <miknet.net> for reporting this and offering an initial patch.
* Various build fixes, thanks Timothy Gu.
* Improved rdiff man page from Debian.
* Improved librsync.spec file for building RPMs.
* Fixed bug #1110812 'internal error: job made no progress'; on large files.
* Moved hosting to https://github.com/librsync/librsync/
* Travis-CI.org integration test at https://travis-ci.org/librsync/librsync/
* Remove bundled copy of popt; it must be installed separately.
* You can set `$LIBTOOLIZE` before running `autogen.sh`, for example on OS X Homebrew where it is called `glibtoolize`.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1126712 - CVE-2014-8242 librsync: MD4 collision file corruption
https://bugzilla.redhat.com/show_bug.cgi?id=1126712
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update csync2' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 2 months
[SECURITY] Fedora EPEL 6 Update: duplicity-0.6.22-4.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-1108
2015-03-08 20:52:13
--------------------------------------------------------------------------------
Name : duplicity
Product : Fedora EPEL 6
Version : 0.6.22
Release : 4.el6
URL : http://www.nongnu.org/duplicity/
Summary : Encrypted bandwidth-efficient backup using rsync algorithm
Description :
Duplicity incrementally backs up files and directory by encrypting
tar-format volumes with GnuPG and uploading them to a remote (or
local) file server. In theory many protocols for connecting to a
file server could be supported; so far ssh/scp, local file access,
rsync, ftp, HSI, WebDAV and Amazon S3 have been written.
Because duplicity uses librsync, the incremental archives are space
efficient and only record the parts of files that have changed since
the last backup. Currently duplicity supports deleted files, full
unix permissions, directories, symbolic links, fifos, device files,
but not hard links.
--------------------------------------------------------------------------------
Update Information:
Changes in librsync 1.0.0 (2015-01-23)
======================================
* SECURITY: CVE-2014-8242: librsync previously used a truncated MD4 "strong" check sum to match blocks. However, MD4 is not cryptographically strong. It's possible that an attacker who can control the contents of one part of a file could use it to control other regions of the file, if it's transferred using librsync/rdiff. For example this might occur in a database, mailbox, or VM image containing some attacker-controlled data. To mitigate this issue, signatures will by default be computed with a 256-bit BLAKE2 hash. Old versions of librsync will complain about a bad magic number when given these signature files. Backward compatibility can be obtained using the new `rdiff sig --hash=md4` option or through specifying the "signature magic" in the API, but this should not be used when either the old or new file contain untrusted data. Deltas generated from those signatures will also use BLAKE2 during generation, but produce output that can be read by old versions. See https://github.com/librsync/librsync/issues/5. Thanks to Michael Samuel <miknet.net> for reporting this and offering an initial patch.
* Various build fixes, thanks Timothy Gu.
* Improved rdiff man page from Debian.
* Improved librsync.spec file for building RPMs.
* Fixed bug #1110812 'internal error: job made no progress'; on large files.
* Moved hosting to https://github.com/librsync/librsync/
* Travis-CI.org integration test at https://travis-ci.org/librsync/librsync/
* Remove bundled copy of popt; it must be installed separately.
* You can set `$LIBTOOLIZE` before running `autogen.sh`, for example on OS X Homebrew where it is called `glibtoolize`.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1126712 - CVE-2014-8242 librsync: MD4 collision file corruption
https://bugzilla.redhat.com/show_bug.cgi?id=1126712
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update duplicity' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 2 months
[SECURITY] Fedora EPEL 6 Update: rdiff-backup-1.2.8-6.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-1108
2015-03-08 20:52:13
--------------------------------------------------------------------------------
Name : rdiff-backup
Product : Fedora EPEL 6
Version : 1.2.8
Release : 6.el6
URL : http://www.nongnu.org/rdiff-backup/
Summary : Convenient and transparent local/remote incremental mirror/backup
Description :
rdiff-backup is a script, written in Python, that backs up one
directory to another and is intended to be run periodically (nightly
from cron for instance). The target directory ends up a copy of the
source directory, but extra reverse diffs are stored in the target
directory, so you can still recover files lost some time ago. The idea
is to combine the best features of a mirror and an incremental
backup. rdiff-backup can also operate in a bandwidth efficient manner
over a pipe, like rsync. Thus you can use rdiff-backup and ssh to
securely back a hard drive up to a remote location, and only the
differences from the previous backup will be transmitted.
--------------------------------------------------------------------------------
Update Information:
Changes in librsync 1.0.0 (2015-01-23)
======================================
* SECURITY: CVE-2014-8242: librsync previously used a truncated MD4 "strong" check sum to match blocks. However, MD4 is not cryptographically strong. It's possible that an attacker who can control the contents of one part of a file could use it to control other regions of the file, if it's transferred using librsync/rdiff. For example this might occur in a database, mailbox, or VM image containing some attacker-controlled data. To mitigate this issue, signatures will by default be computed with a 256-bit BLAKE2 hash. Old versions of librsync will complain about a bad magic number when given these signature files. Backward compatibility can be obtained using the new `rdiff sig --hash=md4` option or through specifying the "signature magic" in the API, but this should not be used when either the old or new file contain untrusted data. Deltas generated from those signatures will also use BLAKE2 during generation, but produce output that can be read by old versions. See https://github.com/librsync/librsync/issues/5. Thanks to Michael Samuel <miknet.net> for reporting this and offering an initial patch.
* Various build fixes, thanks Timothy Gu.
* Improved rdiff man page from Debian.
* Improved librsync.spec file for building RPMs.
* Fixed bug #1110812 'internal error: job made no progress'; on large files.
* Moved hosting to https://github.com/librsync/librsync/
* Travis-CI.org integration test at https://travis-ci.org/librsync/librsync/
* Remove bundled copy of popt; it must be installed separately.
* You can set `$LIBTOOLIZE` before running `autogen.sh`, for example on OS X Homebrew where it is called `glibtoolize`.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1126712 - CVE-2014-8242 librsync: MD4 collision file corruption
https://bugzilla.redhat.com/show_bug.cgi?id=1126712
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update rdiff-backup' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 2 months
[SECURITY] Fedora EPEL 6 Update: librsync-1.0.0-1.el6
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-1108
2015-03-08 20:52:13
--------------------------------------------------------------------------------
Name : librsync
Product : Fedora EPEL 6
Version : 1.0.0
Release : 1.el6
URL : http://librsync.sourcefrog.net/
Summary : Rsync libraries
Description :
librsync implements the "rsync" algorithm, which allows remote
differencing of binary files. librsync computes a delta relative to a
file's checksum, so the two files need not both be present to generate
a delta.
This library was previously known as libhsync up to version 0.9.0.
The current version of this package does not implement the rsync
network protocol and uses a delta format slightly more efficient than
and incompatible with rsync 2.4.6.
--------------------------------------------------------------------------------
Update Information:
Changes in librsync 1.0.0 (2015-01-23)
======================================
* SECURITY: CVE-2014-8242: librsync previously used a truncated MD4 "strong" check sum to match blocks. However, MD4 is not cryptographically strong. It's possible that an attacker who can control the contents of one part of a file could use it to control other regions of the file, if it's transferred using librsync/rdiff. For example this might occur in a database, mailbox, or VM image containing some attacker-controlled data. To mitigate this issue, signatures will by default be computed with a 256-bit BLAKE2 hash. Old versions of librsync will complain about a bad magic number when given these signature files. Backward compatibility can be obtained using the new `rdiff sig --hash=md4` option or through specifying the "signature magic" in the API, but this should not be used when either the old or new file contain untrusted data. Deltas generated from those signatures will also use BLAKE2 during generation, but produce output that can be read by old versions. See https://github.com/librsync/librsync/issues/5. Thanks to Michael Samuel <miknet.net> for reporting this and offering an initial patch.
* Various build fixes, thanks Timothy Gu.
* Improved rdiff man page from Debian.
* Improved librsync.spec file for building RPMs.
* Fixed bug #1110812 'internal error: job made no progress'; on large files.
* Moved hosting to https://github.com/librsync/librsync/
* Travis-CI.org integration test at https://travis-ci.org/librsync/librsync/
* Remove bundled copy of popt; it must be installed separately.
* You can set `$LIBTOOLIZE` before running `autogen.sh`, for example on OS X Homebrew where it is called `glibtoolize`.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1126712 - CVE-2014-8242 librsync: MD4 collision file corruption
https://bugzilla.redhat.com/show_bug.cgi?id=1126712
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update librsync' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 2 months
[SECURITY] Fedora EPEL 5 Update: putty-0.63-4.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-1044
2015-03-08 20:49:56
--------------------------------------------------------------------------------
Name : putty
Product : Fedora EPEL 5
Version : 0.63
Release : 4.el5
URL : http://www.chiark.greenend.org.uk/~sgtatham/putty/
Summary : SSH, Telnet and Rlogin client
Description :
Putty is a SSH, Telnet & Rlogin client - this time for Linux.
--------------------------------------------------------------------------------
Update Information:
Fixed an issue when private keys weren't scrub from memory after use.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1198192 - CVE-2015-2157 putty: failure to scrub private keys from memory after use
https://bugzilla.redhat.com/show_bug.cgi?id=1198192
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update putty' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 2 months
Fedora EPEL 7 Update: oz-0.13.0-1.el7
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-1026
2015-03-08 20:49:21
--------------------------------------------------------------------------------
Name : oz
Product : Fedora EPEL 7
Version : 0.13.0
Release : 1.el7
URL : http://github.com/clalancette/oz
Summary : Library and utilities for automated guest OS installs
Description :
Oz is a set of libraries and utilities for doing automated guest OS
installations, with minimal input from the user.
--------------------------------------------------------------------------------
Update Information:
Update to release 0.13.0
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update oz' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 2 months
Fedora EPEL 7 Update: getmail-4.47.0-1.el7
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-1106
2015-03-08 20:52:09
--------------------------------------------------------------------------------
Name : getmail
Product : Fedora EPEL 7
Version : 4.47.0
Release : 1.el7
URL : http://pyropus.ca/software/getmail/
Summary : POP3, IMAP4 and SDPS mail retriever with Maildir delivery
Description :
getmail is a secure, flexible, reliable and easy-to-use
mail retriever for POP3, IMAP4 and SDPS.
It delivers mail into a Maildir or mbox file.
It is designed to replace other mail retrievers such as fetchmail.
Getmail is written entirely in python.
--------------------------------------------------------------------------------
Update Information:
new upstream release
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update getmail' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 2 months
Fedora EPEL 5 Update: mydns-1.2.8.31-2.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-0996
2015-02-27 21:03:57
--------------------------------------------------------------------------------
Name : mydns
Product : Fedora EPEL 5
Version : 1.2.8.31
Release : 2.el5
URL : http://mydns-ng.com/
Summary : A Database based DNS server
Description :
A nameserver that serves records directly from your database.
--------------------------------------------------------------------------------
Update Information:
Fix build of the mydns-pgsql so that it actually supports pgsql (#985909)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #985909 - mydns-pgsql is built for MySQL
https://bugzilla.redhat.com/show_bug.cgi?id=985909
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update mydns' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 2 months
Fedora EPEL 5 Update: opendkim-2.10.1-2.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-1138
2015-03-08 20:53:22
--------------------------------------------------------------------------------
Name : opendkim
Product : Fedora EPEL 5
Version : 2.10.1
Release : 2.el5
URL : http://opendkim.org/
Summary : A DomainKeys Identified Mail (DKIM) milter to sign and/or verify mail
Description :
OpenDKIM allows signing and/or verification of email through an open source
library that implements the DKIM service, plus a milter-based filter
application that can plug in to any milter-aware MTA, including sendmail,
Postfix, or any other MTA that supports the milter protocol.
--------------------------------------------------------------------------------
Update Information:
Updating to 2.10.1 source (bug #1178373) and adding IPv6 localhost (::1) to default TrustedHosts file (bug #1049204).
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.10.1 upstream source, addition of README.fedora file, and various bug fixes.
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to 2.9.2-2
This build is primarily to address SELinux issues, and no longer auto-creates default keys on startup.
Privileged user must now generate keys after install, so they can be owned by root.
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
Updating to newer upstream source: 2.9.2
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #973541 - opendkim-2.9.2 is available
https://bugzilla.redhat.com/show_bug.cgi?id=973541
[ 2 ] Bug #1178373 - opendkim-2.10.1 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1178373
[ 3 ] Bug #1049204 - TrustedHosts is missing IPv6 ::1
https://bugzilla.redhat.com/show_bug.cgi?id=1049204
[ 4 ] Bug #891292 - SELinux is preventing /usr/sbin/opendkim from using the dac_override capability
https://bugzilla.redhat.com/show_bug.cgi?id=891292
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update opendkim' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 2 months
[SECURITY] Fedora EPEL 5 Update: duplicity-0.6.21-2.el5
by updates@fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-1098
2015-03-08 20:51:46
--------------------------------------------------------------------------------
Name : duplicity
Product : Fedora EPEL 5
Version : 0.6.21
Release : 2.el5
URL : http://www.nongnu.org/duplicity/
Summary : Encrypted bandwidth-efficient backup using rsync algorithm
Description :
Duplicity incrementally backs up files and directory by encrypting
tar-format volumes with GnuPG and uploading them to a remote (or
local) file server. In theory many protocols for connecting to a
file server could be supported; so far ssh/scp, local file access,
rsync, ftp, HSI, WebDAV and Amazon S3 have been written.
Because duplicity uses librsync, the incremental archives are space
efficient and only record the parts of files that have changed since
the last backup. Currently duplicity supports deleted files, full
unix permissions, directories, symbolic links, fifos, device files,
but not hard links.
--------------------------------------------------------------------------------
Update Information:
Changes in librsync 1.0.0 (2015-01-23)
======================================
* SECURITY: CVE-2014-8242: librsync previously used a truncated MD4 "strong" check sum to match blocks. However, MD4 is not cryptographically strong. It's possible that an attacker who can control the contents of one part of a file could use it to control other regions of the file, if it's transferred using librsync/rdiff. For example this might occur in a database, mailbox, or VM image containing some attacker-controlled data. To mitigate this issue, signatures will by default be computed with a 256-bit BLAKE2 hash. Old versions of librsync will complain about a bad magic number when given these signature files. Backward compatibility can be obtained using the new `rdiff sig --hash=md4` option or through specifying the "signature magic" in the API, but this should not be used when either the old or new file contain untrusted data. Deltas generated from those signatures will also use BLAKE2 during generation, but produce output that can be read by old versions. See https://github.com/librsync/librsync/issues/5. Thanks to Michael Samuel <miknet.net> for reporting this and offering an initial patch.
* Various build fixes, thanks Timothy Gu.
* Improved rdiff man page from Debian.
* Improved librsync.spec file for building RPMs.
* Fixed bug #1110812 'internal error: job made no progress'; on large files.
* Moved hosting to https://github.com/librsync/librsync/
* Travis-CI.org integration test at https://travis-ci.org/librsync/librsync/
* Remove bundled copy of popt; it must be installed separately.
* You can set `$LIBTOOLIZE` before running `autogen.sh`, for example on OS X Homebrew where it is called `glibtoolize`.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1126712 - CVE-2014-8242 librsync: MD4 collision file corruption
https://bugzilla.redhat.com/show_bug.cgi?id=1126712
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update duplicity' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
9 years, 2 months