[Bug 1439748] New: CVE-2017-3204 golang: Go SSH library does not verify host keys by default
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1439748
Bug ID: 1439748
Summary: CVE-2017-3204 golang: Go SSH library does not verify
host keys by default
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: admiller(a)redhat.com, amurdaca(a)redhat.com,
aortega(a)redhat.com, apevec(a)redhat.com,
ayoung(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, chrisw(a)redhat.com,
cvsbot-xmlrpc(a)redhat.com, dedgar(a)redhat.com,
dmcphers(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jcajka(a)redhat.com, jgoulding(a)redhat.com,
jjoyce(a)redhat.com, jkeck(a)redhat.com,
joelsmith(a)redhat.com, jschluet(a)redhat.com,
kbasil(a)redhat.com, kseifried(a)redhat.com,
lemenkov(a)gmail.com, lhh(a)redhat.com, lpeer(a)redhat.com,
markmc(a)redhat.com, rbryant(a)redhat.com,
renich(a)woralelandia.com, sclewis(a)redhat.com, s(a)shk.io,
tdawson(a)redhat.com, tdecacqu(a)redhat.com,
vbatts(a)redhat.com
The Go SSH library (x/crypto/ssh) by default does not verify host keys,
facilitating man-in-the-middle attacks.
Upstream bug:
https://github.com/golang/go/issues/19767
Upstream patch:
https://github.com/golang/crypto/commit/e4e2799dd7aab89f583e1d898300d9636...
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1455190] New: CVE-2017-8932 golang: Elliptic curvers carry propagation issue in x86-64 P-256 [epel-6]
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1455190
Bug ID: 1455190
Summary: CVE-2017-8932 golang: Elliptic curvers carry
propagation issue in x86-64 P-256 [epel-6]
Product: Fedora EPEL
Version: el6
Component: golang
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: admiller(a)redhat.com
Reporter: anemec(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, amurdaca(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jcajka(a)redhat.com, s(a)shk.io, ttomecek(a)redhat.com
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1456243] New: golang-googlecode-go-exp: FTBFS due to missing dependencies on Fedora 26+
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1456243
Bug ID: 1456243
Summary: golang-googlecode-go-exp: FTBFS due to missing
dependencies on Fedora 26+
Product: Fedora
Version: 26
Component: golang-googlecode-go-exp
Assignee: fpokorny(a)redhat.com
Reporter: decathorpe(a)gmail.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fpokorny(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jchaloup(a)redhat.com, vbatts(a)redhat.com
Package golang-googlecode-go-exp fails to build from source in Fedora 26+, due
to the (now) missing dependency golang(golang.org/x/text/collate/colltab),
which is no longer provided by the golang-googlecode-text package.
But, it looks like this dependency is no longer even used by more recent
versions of this package, so bumping to a recent snapshot (and correcting the
Requires) should fix this, as far as I can tell from looking at it briefly.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1465278] New: broken dependency for runc in Fedora 26: depends on criu on i686
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1465278
Bug ID: 1465278
Summary: broken dependency for runc in Fedora 26: depends on
criu on i686
Product: Fedora
Version: 26
Component: runc
Assignee: jchaloup(a)redhat.com
Reporter: opensource(a)till.name
QA Contact: extras-qa(a)fedoraproject.org
CC: amurdaca(a)redhat.com, bbaude(a)redhat.com,
dwalsh(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jchaloup(a)redhat.com, lsm5(a)redhat.com,
TicoTimo(a)gmail.com
bug for freeze exception process
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months
[Bug 1465019] New: Tracker for gofed
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1465019
Bug ID: 1465019
Summary: Tracker for gofed
Product: Fedora
Version: rawhide
Component: gofed
Assignee: jchaloup(a)redhat.com
Reporter: jchaloup(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: fale(a)redhat.com,
golang-updates(a)lists.fedoraproject.org,
jchaloup(a)redhat.com
Tracker for async updates of gofed for rawhide and other fedora distribution.
As golang devel packages are used only as a build-time dependency at the
moment, this tracker keeps updates and other information about this package,
e.g. broken dependencies, exceptions, important pieces of information and other
issues.
--
You are receiving this mail because:
You are on the CC list for the bug.
6 years, 10 months