--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2016-911ea9b639
2017-01-06 04:21:40.191685
--------------------------------------------------------------------------------
Name : python-wikitcms
Product : Fedora EPEL 7
Version : 2.1.9
Release : 1.el7
URL :
https://pagure.io/fedora-qa/python-wikitcms
Summary : Fedora QA wiki test management Python library
Description :
python-wikitcms is a library for interacting with Fedora's wiki-based 'test
management' system. It can:
* Create the pages for release validation test events
* Find existing release validation event pages, in various ways
* Report test results
The wiki-based test management system itself is documented at:
https://fedoraproject.org/wiki/Wikitcms
--------------------------------------------------------------------------------
Update Information:
python-wikitcms 2.1.9 is a **SECURITY** fix for an issue with potentially
serious consequences but very limited scope. If an administrator of a wiki you
talked to using python-wikitcms were malicious, they could cause arbitrary code
execution as the user running wikitcms. No-one besides a wiki administrator
could do this, as it requires crafting the wiki's response to an edit request to
include a malicious payload. fedfind 3.0 changes how fedfind finds images for
composes without metadata (which is basically milestone - Alpha / Beta - and
stable releases). Formerly it found them by scraping rsync output, which was
slow, generated quite a lot of load on both server and client, and was
vulnerable to the rsync server being full. We have now tweaked things so that
the primary mirror has `imagelist` files for the `fedora`, `alt` and `archive`
trees which list every single image file - but no other files - in those trees.
fedfind now simply parses these `imagelist` files to find images. As the files
only list images they are pretty small (the biggest is under 500KiB) and they
are cached locally and only re-downloaded when they change, this is much faster,
more efficient, and uses less bandwidth. There are also some changes to ensure
the tests run properly on EL 6, EL 7 and Fedora 23, and a missing dependency for
EL 6 was added - `argparse` is a part of the Python standard library for all the
other distros, but for EL 6 it is still a separate package. fedfind 3.1 changes
how fedfind handles metadata for composes which were originally created by Pungi
4 and had real metadata, but were then modified in some ways and had their
metadata removed. This includes milestone and stable releases for Fedora 24 and
later: when these are placed in their 'final' locations on the mirrors, some
contents are split into different locations and some deliverables are removed.
Previously, fedfind would simply synthesize metadata for these composes, as it
does for pre-Pungi 4 composes. Now, it first attempts to find the original
metadata (from [
PDC](https://pdc.fedoraproject.org/)) and adjust it for the
modified image locations, while preserving all the other image attributes from
the original metadata (including ones it could not synthesize). It will only
fall back to synthesizing the metadata if it cannot find corresponding metadata
from PDC. The practical result of this is that you should get more reliable and
complete metadata for these composes. fedfind 3.2 adds support for the [post-
release live respin
composes](https://dl.fedoraproject.org/pub/alt/live-
respins/) to fedfind. These work a little differently to most other compose
types: please see the documentation for more information. This support is
primarily intended to enable testing of these composes in
[openQA](https://openqa.fedoraproject.org).
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update python-wikitcms' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------