[python-blivet] - Remove a problematic remnant of singlePV. (dlehman) - Remove all traces of singlePV. (sbueno+anaco
by Brian C. Lane
commit 7a686fe26552f0471bce293db55709e982713b3f
Author: Brian C. Lane <bcl(a)redhat.com>
Date: Tue Sep 30 16:56:57 2014 -0700
- Remove a problematic remnant of singlePV. (dlehman)
- Remove all traces of singlePV. (sbueno+anaconda)
- Change the default /boot part on s390x to not be lvm. (sbueno+anaconda)
- Remove redundant check for parents in Blivet.newBTRFS. (dlehman)
- Use Decimal for math in Size.convertTo. (dlehman)
- Filter out free regions too small for alignment of partitions. (dlehman)
- Disable LVM autobackup when doing image installs (#1066004) (wwoods)
- Add attribute 'flags.lvm_metadata_backup' (wwoods)
- lvm_test: refactoring + minor fix (wwoods)
- devicelibs.lvm: refactor _getConfigArgs()/lvm() (wwoods)
- devicelibs.lvm: fix pvmove(src, dest=DESTPATH) (wwoods)
- Only pad for md metadata if pvs use multiple disks. (dlehman)
- Align free regions used for partition growing calculations. (dlehman)
- Try to align end sector up when aligning new partitions. (dlehman)
- Remove obsolete conversion of size to float. (dlehman)
- Honor size specified for explicit extended partition requests. (dlehman)
- Honor zerombr regardless of clearpart setting. (dlehman)
- Fix treatment of percent as lvm lv size spec. (dlehman)
- Change variable keyword (#1075671) (amulhern)
- Remove unused import (#1075671) (amulhern)
- Don't mix target and discovery credentials (#1037564) (mkolman)
- Make sure /boot/efi is metadata 1.0 if it's on mdraid. (pjones)
- iscsi: fix root argument being overriden by local variable (#1144463)
(rvykydal)
- iscsi: add iscsi singleton back (#1144463) (rvykydal)
.gitignore | 1 +
python-blivet.spec | 29 ++++++++++++++++++++++++++++-
sources | 2 +-
3 files changed, 30 insertions(+), 2 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index fd6a860..c871510 100644
--- a/.gitignore
+++ b/.gitignore
@@ -59,3 +59,4 @@
/blivet-0.62.tar.gz
/blivet-0.63.tar.gz
/blivet-0.64.tar.gz
+/blivet-0.65.tar.gz
diff --git a/python-blivet.spec b/python-blivet.spec
index 82cfdce..7e06630 100644
--- a/python-blivet.spec
+++ b/python-blivet.spec
@@ -1,7 +1,7 @@
Summary: A python module for system storage configuration
Name: python-blivet
Url: http://fedoraproject.org/wiki/blivet
-Version: 0.64
+Version: 0.65
Release: 1%{?dist}
Epoch: 1
License: LGPLv2+
@@ -65,6 +65,33 @@ make DESTDIR=%{buildroot} install
%{python_sitelib}/*
%changelog
+* Tue Sep 30 2014 Brian C. Lane <bcl(a)redhat.com> - 0.65-1
+- Remove a problematic remnant of singlePV. (dlehman)
+- Remove all traces of singlePV. (sbueno+anaconda)
+- Change the default /boot part on s390x to not be lvm. (sbueno+anaconda)
+- Remove redundant check for parents in Blivet.newBTRFS. (dlehman)
+- Use Decimal for math in Size.convertTo. (dlehman)
+- Filter out free regions too small for alignment of partitions. (dlehman)
+- Disable LVM autobackup when doing image installs (#1066004) (wwoods)
+- Add attribute 'flags.lvm_metadata_backup' (wwoods)
+- lvm_test: refactoring + minor fix (wwoods)
+- devicelibs.lvm: refactor _getConfigArgs()/lvm() (wwoods)
+- devicelibs.lvm: fix pvmove(src, dest=DESTPATH) (wwoods)
+- Only pad for md metadata if pvs use multiple disks. (dlehman)
+- Align free regions used for partition growing calculations. (dlehman)
+- Try to align end sector up when aligning new partitions. (dlehman)
+- Remove obsolete conversion of size to float. (dlehman)
+- Honor size specified for explicit extended partition requests. (dlehman)
+- Honor zerombr regardless of clearpart setting. (dlehman)
+- Fix treatment of percent as lvm lv size spec. (dlehman)
+- Change variable keyword (#1075671) (amulhern)
+- Remove unused import (#1075671) (amulhern)
+- Don't mix target and discovery credentials (#1037564) (mkolman)
+- Make sure /boot/efi is metadata 1.0 if it's on mdraid. (pjones)
+- iscsi: fix root argument being overriden by local variable (#1144463)
+ (rvykydal)
+- iscsi: add iscsi singleton back (#1144463) (rvykydal)
+
* Fri Sep 19 2014 Brian C. Lane <bcl(a)redhat.com> - 0.64-1
- Fix pylint errors from recent btrfs commits. (dlehman)
- Only cancel actions on disks related to the one we are hiding. (dlehman)
diff --git a/sources b/sources
index cd5eee4..ac52b7c 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-ef3eb66203f45dea4236a58ffbfd5d20 blivet-0.64.tar.gz
+14023b2b765448f6ff0e4505b0ff5a98 blivet-0.65.tar.gz
8Â years, 12Â months
[openstack-keystone] Update to upstream 2014.2.rc1
by Alan Pevec
commit 46f397d8ce145d339ca7f241dd1b40ce68d92f6d
Author: Alan Pevec <alan.pevec(a)redhat.com>
Date: Wed Oct 1 01:04:01 2014 +0200
Update to upstream 2014.2.rc1
.gitignore | 1 +
0001-remove-runtime-dep-on-python-pbr.patch | 14 +++++-----
...-parameter-values-with-keystone-dist.conf.patch | 16 +++++-----
openstack-keystone.spec | 29 +++++++++++--------
sources | 2 +-
5 files changed, 34 insertions(+), 28 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index 8bbf415..4a24c70 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@
/keystone-2014.2.b1.tar.gz
/keystone-2014.2.b2.tar.gz
/keystone-2014.2.b3.tar.gz
+/keystone-2014.2.rc1.tar.gz
diff --git a/0001-remove-runtime-dep-on-python-pbr.patch b/0001-remove-runtime-dep-on-python-pbr.patch
index f2f8609..eeefe4d 100644
--- a/0001-remove-runtime-dep-on-python-pbr.patch
+++ b/0001-remove-runtime-dep-on-python-pbr.patch
@@ -1,4 +1,4 @@
-From 3837f8ccf791cae1f6abc10d20e0aa4ce99038f0 Mon Sep 17 00:00:00 2001
+From 255547c739d270857c075c5050683d0dab82c511 Mon Sep 17 00:00:00 2001
From: Alan Pevec <apevec(a)redhat.com>
Date: Mon, 9 Sep 2013 00:38:42 +0200
Subject: [PATCH] remove runtime dep on python-pbr
@@ -9,18 +9,18 @@ Subject: [PATCH] remove runtime dep on python-pbr
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/bin/keystone-all b/bin/keystone-all
-index 732ee8e..e548763 100755
+index 89e5128..90f6f8e 100755
--- a/bin/keystone-all
+++ b/bin/keystone-all
-@@ -21,7 +21,6 @@ import sys
+@@ -20,7 +20,6 @@ import socket
+ import sys
from oslo import i18n
- from paste import deploy
-import pbr.version
# If ../keystone/__init__.py exists, add ../ to Python search path, so that
-@@ -117,7 +116,7 @@ if __name__ == '__main__':
+@@ -127,7 +126,7 @@ if __name__ == '__main__':
config.set_default_for_default_log_levels()
CONF(project='keystone',
@@ -30,7 +30,7 @@ index 732ee8e..e548763 100755
config.setup_logging()
diff --git a/keystone/cli.py b/keystone/cli.py
-index e8c84af..140832d 100644
+index 4cc20eb..50d7880 100644
--- a/keystone/cli.py
+++ b/keystone/cli.py
@@ -17,7 +17,6 @@ from __future__ import absolute_import
@@ -41,7 +41,7 @@ index e8c84af..140832d 100644
from keystone import assignment
from keystone.common import openssl
-@@ -285,7 +284,7 @@ def main(argv=None, config_files=None):
+@@ -300,7 +299,7 @@ def main(argv=None, config_files=None):
CONF(args=argv[1:],
project='keystone',
diff --git a/0002-sync-parameter-values-with-keystone-dist.conf.patch b/0002-sync-parameter-values-with-keystone-dist.conf.patch
index c6392fa..629d699 100644
--- a/0002-sync-parameter-values-with-keystone-dist.conf.patch
+++ b/0002-sync-parameter-values-with-keystone-dist.conf.patch
@@ -1,4 +1,4 @@
-From 21a7072cd41ce9f209a41d2b4e5786b8667ae293 Mon Sep 17 00:00:00 2001
+From 30caade704deb230ba52b4f036982168b4fbba3f Mon Sep 17 00:00:00 2001
From: Alan Pevec <apevec(a)redhat.com>
Date: Mon, 9 Sep 2013 15:22:20 +0200
Subject: [PATCH] sync parameter values with keystone-dist.conf
@@ -11,10 +11,10 @@ Change-Id: If36c384f86843a6506a494d79beca65639fb3480
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/etc/keystone.conf.sample b/etc/keystone.conf.sample
-index 9f6051b..f7f6a0e 100644
+index c058a03..6ef183e 100644
--- a/etc/keystone.conf.sample
+++ b/etc/keystone.conf.sample
-@@ -347,7 +347,7 @@
+@@ -353,7 +353,7 @@
#verbose=false
# Log output to standard error. (boolean value)
@@ -23,7 +23,7 @@ index 9f6051b..f7f6a0e 100644
# Format string to use for log messages with context. (string
# value)
-@@ -402,10 +402,11 @@
+@@ -408,10 +408,11 @@
# %(default)s . (string value)
#log_date_format=%Y-%m-%d %H:%M:%S
@@ -38,7 +38,7 @@ index 9f6051b..f7f6a0e 100644
# (Optional) The base directory used for relative --log-file
# paths. (string value)
-@@ -537,7 +538,7 @@
+@@ -572,7 +573,7 @@
# Catalog template file name for use with the template catalog
# backend. (string value)
@@ -47,7 +47,7 @@ index 9f6051b..f7f6a0e 100644
# Catalog backend driver. (string value)
#driver=keystone.catalog.backends.sql.Catalog
-@@ -587,7 +588,7 @@
+@@ -629,7 +630,7 @@
# Deprecated group/name - [DEFAULT]/sql_connection
# Deprecated group/name - [DATABASE]/sql_connection
# Deprecated group/name - [sql]/connection
@@ -56,7 +56,7 @@ index 9f6051b..f7f6a0e 100644
# The SQLAlchemy connection string to use to connect to the
# slave database. (string value)
-@@ -680,7 +681,7 @@
+@@ -722,7 +723,7 @@
#
# EC2Credential backend driver. (string value)
@@ -65,7 +65,7 @@ index 9f6051b..f7f6a0e 100644
[endpoint_filter]
-@@ -1241,7 +1242,7 @@
+@@ -1307,7 +1308,7 @@
# Name of the paste configuration file that defines the
# available pipelines. (string value)
diff --git a/openstack-keystone.spec b/openstack-keystone.spec
index 8ba5a13..9df6661 100644
--- a/openstack-keystone.spec
+++ b/openstack-keystone.spec
@@ -1,20 +1,17 @@
-#
-# This is 2014.2 Juno-3 milestone
-#
%global release_name juno
-%global milestone 3
+%global milestone rc1
%global with_doc %{!?_without_doc:1}%{?_without_doc:0}
Name: openstack-keystone
Version: 2014.2
-Release: 0.4.b%{milestone}%{?dist}
+Release: 0.5.%{milestone}%{?dist}
Summary: OpenStack Identity Service
License: ASL 2.0
URL: http://keystone.openstack.org/
#Source0: http://launchpad.net/keystone/%{release_name}/%{version}/+download/keysto...
-Source0: http://launchpad.net/keystone/%{release_name}/%{release_name}-%{milestone...
+Source0: http://launchpad.net/keystone/%{release_name}/%{release_name}-%{milestone...
Source1: openstack-keystone.logrotate
Source2: openstack-keystone.service
Source3: openstack-keystone.sysctl
@@ -26,20 +23,18 @@ Source23: openstack-keystone.upstart
#
-# patches_base=2014.2.b3
+# patches_base=2014.2.rc1
#
Patch0001: 0001-remove-runtime-dep-on-python-pbr.patch
Patch0002: 0002-sync-parameter-values-with-keystone-dist.conf.patch
BuildArch: noarch
BuildRequires: python2-devel
-BuildRequires: python-sphinx >= 1.1.2
-BuildRequires: python-oslo-sphinx
BuildRequires: python-pbr
BuildRequires: python-d2to1
Requires: python-keystone = %{version}-%{release}
-Requires: python-keystoneclient >= 1:0.9.0
+Requires: python-keystoneclient >= 1:0.10.0
%if 0%{?rhel} == 6
Requires(post): chkconfig
@@ -107,6 +102,13 @@ This package contains the Keystone Python library.
Summary: Documentation for OpenStack Identity Service
Group: Documentation
+BuildRequires: python-sphinx >= 1.1.2
+BuildRequires: python-oslo-sphinx
+# for API autodoc
+BuildRequires: python-keystonemiddleware
+BuildRequires: python-ldappool
+
+
%description doc
Keystone is a Python implementation of the OpenStack
(http://www.openstack.org) identity service API.
@@ -115,7 +117,7 @@ This package contains documentation for Keystone.
%endif
%prep
-%setup -q -n keystone-%{version}.b%{milestone}
+%setup -q -n keystone-%{version}.%{milestone}
%patch0001 -p1
%patch0002 -p1
@@ -129,7 +131,7 @@ rm -f test-requirements.txt requirements.txt
# Remove dependency on pbr and set version as per rpm
sed -i s/REDHATKEYSTONEVERSION/%{version}/ bin/keystone-all keystone/cli.py
-sed -i 's/%{version}.b%{milestone}/%{version}/' PKG-INFO
+sed -i 's/%{version}.%{milestone}/%{version}/' PKG-INFO
# make doc build compatible with python-oslo-sphinx RPM
sed -i 's/oslosphinx/oslo.sphinx/' doc/source/conf.py
@@ -273,6 +275,9 @@ fi
%endif
%changelog
+* Wed Oct 01 2014 Alan Pevec <alan.pevec(a)redhat.com> 2014.2-0.5.rc1
+- Update to upstream 2014.2.rc1
+
* Thu Sep 11 2014 Alan Pevec <apevec(a)redhat.com> 2014.2-0.4.b3
- update dependencies
diff --git a/sources b/sources
index 6556ffb..3ea7e9e 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-bca54f5c7638ac4c1e31f0df704d6e1c keystone-2014.2.b3.tar.gz
+facdb53a629ded3146856d11d048ebfe keystone-2014.2.rc1.tar.gz
8Â years, 12Â months
[krb5/f19] * Tue Sep 30 2014 Roland Mainz <rmainz@redhat.com> - 1.11.3-29 - fix for CVE-2014-5351 (#1145425) "k
by Roland Mainz
commit 798947e47e947ecd25fe34cb91dd2ebe6ce0dbf8
Author: Roland Mainz <rmainz(a)redhat.com>
Date: Wed Oct 1 01:07:05 2014 +0200
* Tue Sep 30 2014 Roland Mainz <rmainz(a)redhat.com> - 1.11.3-29
- fix for CVE-2014-5351 (#1145425) "krb5: current keys returned when
randomizing the keys for a service principal"
krb5-11.1_CVE-2014-5351_001.patch | 86 +++++++++++++++++++++++++++++++++++++
krb5.spec | 10 ++++-
2 files changed, 95 insertions(+), 1 deletions(-)
---
diff --git a/krb5-11.1_CVE-2014-5351_001.patch b/krb5-11.1_CVE-2014-5351_001.patch
new file mode 100644
index 0000000..793c93c
--- /dev/null
+++ b/krb5-11.1_CVE-2014-5351_001.patch
@@ -0,0 +1,86 @@
+From 3bf9e33f9d66c0eef486cbd83f9e4f13a74d12c3 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson(a)mit.edu>
+Date: Thu, 21 Aug 2014 13:52:07 -0400
+Subject: [PATCH] Return only new keys in randkey [CVE-2014-5351]
+
+In kadmind's randkey operation, if a client specifies the keepold
+flag, do not include the preserved old keys in the response.
+
+CVE-2014-5351:
+
+An authenticated remote attacker can retrieve the current keys for a
+service principal when generating a new set of keys for that
+principal. The attacker needs to be authenticated as a user who has
+the elevated privilege for randomizing the keys of other principals.
+
+Normally, when a Kerberos administrator randomizes the keys of a
+service principal, kadmind returns only the new keys. This prevents
+an administrator who lacks legitimate privileged access to a service
+from forging tickets to authenticate to that service. If the
+"keepold" flag to the kadmin randkey RPC operation is true, kadmind
+retains the old keys in the KDC database as intended, but also
+unexpectedly returns the old keys to the client, which exposes the
+service to ticket forgery attacks from the administrator.
+
+A mitigating factor is that legitimate clients of the affected service
+will start failing to authenticate to the service once they begin to
+receive service tickets encrypted in the new keys. The affected
+service will be unable to decrypt the newly issued tickets, possibly
+alerting the legitimate administrator of the affected service.
+
+CVSSv2: AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C
+
+[tlyu(a)mit.edu: CVE description and CVSS score]
+
+(cherry picked from commit af0ed4df4dfae762ab5fb605f5a0c8f59cb4f6ca)
+
+ticket: 8018
+version_fixed: 1.13
+status: resolved
+---
+diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
+index ae36841..dc8393f 100644
+--- a/src/lib/kadm5/srv/svr_principal.c
++++ b/src/lib/kadm5/srv/svr_principal.c
+@@ -331,6 +331,20 @@ check_1_6_dummy(kadm5_principal_ent_t entry, long mask,
+ *passptr = NULL;
+ }
+
++/* Return the number of keys with the newest kvno. Assumes that all key data
++ * with the newest kvno are at the front of the key data array. */
++static int
++count_new_keys(int n_key_data, krb5_key_data *key_data)
++{
++ int n;
++
++ for (n = 1; n < n_key_data; n++) {
++ if (key_data[n - 1].key_data_kvno != key_data[n].key_data_kvno)
++ return n;
++ }
++ return n_key_data;
++}
++
+ kadm5_ret_t
+ kadm5_create_principal(void *server_handle,
+ kadm5_principal_ent_t entry, long mask,
+@@ -1693,7 +1707,7 @@ kadm5_randkey_principal_3(void *server_handle,
+ osa_princ_ent_rec adb;
+ krb5_int32 now;
+ kadm5_policy_ent_rec pol;
+- int ret, last_pwd, have_pol = 0;
++ int ret, last_pwd, n_new_keys, have_pol = 0;
+ kadm5_server_handle_t handle = server_handle;
+ krb5_keyblock *act_mkey;
+ int new_n_ks_tuple = 0;
+@@ -1781,8 +1795,9 @@ kadm5_randkey_principal_3(void *server_handle,
+ kdb->fail_auth_count = 0;
+
+ if (keyblocks) {
+- ret = decrypt_key_data(handle->context,
+- kdb->n_key_data, kdb->key_data,
++ /* Return only the new keys added by krb5_dbe_crk. */
++ n_new_keys = count_new_keys(kdb->n_key_data, kdb->key_data);
++ ret = decrypt_key_data(handle->context, n_new_keys, kdb->key_data,
+ keyblocks, n_keys);
+ if (ret)
+ goto done;
diff --git a/krb5.spec b/krb5.spec
index 813917d..0fcbd30 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -32,7 +32,7 @@
Summary: The Kerberos network authentication system
Name: krb5
Version: 1.11.3
-Release: 28%{?dist}
+Release: 29%{?dist}
# Maybe we should explode from the now-available-to-everybody tarball instead?
# http://web.mit.edu/kerberos/dist/krb5/1.11/krb5-1.11.3-signed.tar
Source0: krb5-%{version}.tar.gz
@@ -147,6 +147,8 @@ Patch306: 0006-Use-more-randomness-for-ksu-secondary-cache-names.patch
Patch307: 0007-Make-krb5_cc_new_unique-create-DIR-directories.patch
Patch308: krb5-1.11-base64-exports.patch
+Patch309: krb5-11.1_CVE-2014-5351_001.patch
+
License: MIT
URL: http://web.mit.edu/kerberos/www/
Group: System Environment/Libraries
@@ -351,6 +353,8 @@ ln -s NOTICE LICENSE
%patch307 -p1 -b .Make-krb5_cc_new_unique-create-DIR-directories
%patch308 -p1 -b .base64-exports
+%patch309 -p1
+
%patch60 -p1 -b .pam
%patch63 -p1 -b .selinux-label
@@ -1011,6 +1015,10 @@ exit 0
%{_sbindir}/uuserver
%changelog
+* Tue Sep 30 2014 Roland Mainz <rmainz(a)redhat.com> - 1.11.3-29
+- fix for CVE-2014-5351 (#1145425) "krb5: current keys returned when
+ randomizing the keys for a service principal"
+
* Sat Sep 6 2014 Nalin Dahyabhai <nalin(a)redhat.com> - 1.11.3-28
- replace older proposed changes for ksu with backports of the changes
after review and merging upstream (#1015559, #1026099, #1118347)
8Â years, 12Â months
[tomcatjss/f21] Resolves: rhbz #871171,1058366
by Christina Fu
commit b35b7757f95cc388773e890d1f329f73d9aeaa31
Author: Christina Fu <cfu(a)redhat.com>
Date: Tue Sep 30 16:11:29 2014 -0700
Resolves: rhbz #871171,1058366
* Bugzilla Bug #871171 - Provide Tomcat support for TLS v1.1 and TLS v1.2 (Tomcatjss)
* Bugzilla Bug #1058366 - NullPointerException in tomcatjss searching for attribute "clientauth"
.gitignore | 1 +
sources | 2 +-
tomcatjss.spec | 25 ++++++++++++++++++++-----
3 files changed, 22 insertions(+), 6 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index ddf6197..be96159 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@ tomcatjss-1.2.0.tar.gz
/tomcatjss-6.0.2.tar.gz
/tomcatjss-7.0.0.tar.gz
/tomcatjss-7.1.0.tar.gz
+/tomcatjss-7.1.1.tar.gz
diff --git a/sources b/sources
index ab749d6..a382a9b 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-43566b6cd9249b4e861c5a1646de679b tomcatjss-7.1.0.tar.gz
+54d88b865e5e13cb2a4b3f6874a33cdb tomcatjss-7.1.1.tar.gz
diff --git a/tomcatjss.spec b/tomcatjss.spec
index 8c0c2de..48d8a28 100644
--- a/tomcatjss.spec
+++ b/tomcatjss.spec
@@ -1,6 +1,6 @@
Name: tomcatjss
-Version: 7.1.0
-Release: 6%{?dist}
+Version: 7.1.1
+Release: 1%{?dist}
Summary: JSSE implementation using JSS for Tomcat
URL: http://pki.fedoraproject.org/
License: LGPLv2+
@@ -17,12 +17,16 @@ Source0: http://pki.fedoraproject.org/pki/sources/%{name}/%{name}-%{version}.ta
BuildRequires: ant
BuildRequires: java-devel
BuildRequires: jpackage-utils >= 0:1.7.5-15
-BuildRequires: jss >= 4.2.6-24
+BuildRequires: jss >= 4.2.6-35
BuildRequires: tomcat >= 7.0.40
+%if 0%{?fedora} >= 21
Requires: java-headless
+%else
+Requires: java
+%endif
Requires: jpackage-utils >= 0:1.7.5-15
-Requires: jss >= 4.2.6-24
+Requires: jss >= 4.2.6-35
Requires: tomcat >= 7.0.40
# The 'tomcatjss' package conflicts with the 'tomcat-native' package
@@ -63,6 +67,10 @@ unzip %{name}-%{version}.zip -d %{buildroot}
# Install our files
cd %{buildroot}%{_javadir}
+%if 0%{?rhel} || 0%{?fedora} < 21
+mv %{name}.jar %{name}-%{version}.jar
+ln -s %{name}-%{version}.jar %{name}.jar
+%endif
%clean
rm -rf %{buildroot}
@@ -73,6 +81,13 @@ rm -rf %{buildroot}
%{_javadir}/*
%changelog
+* Tue Sep 30 2014 Christina Fu <cfu(a)redhat.com> 7.1.1-1
+- Bugzilla Bug #1058366 NullPointerException in tomcatjss searching
+ for attribute "clientauth" (cfu)
+- Bugzilla Bug #871171 - Provide Tomcat support for TLS v1.1 and
+ TLS v1.2 (cfu)
+- Bumped revision to 7.1.1
+
* Sun Jun 08 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 7.1.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
@@ -100,7 +115,7 @@ rm -rf %{buildroot}
- PKI TRAC Ticket #283 - Dogtag 10: Integrate Tomcat 6 'tomcatjss.jar' and
Tomcat 7 'tomcat7jss.jar' in Fedora 18 tomcatjss package
-* Wed Jul 26 2012 Matthew Harmsen <mharmsen(a)redhat.com> 7.0.0-2
+* Thu Jul 26 2012 Matthew Harmsen <mharmsen(a)redhat.com> 7.0.0-2
- Fixed runtime 'Requires' cut/paste typos
* Wed Jun 06 2012 Matthew Harmsen <mharmsen(a)redhat.com> 7.0.0-1
8Â years, 12Â months
[tomcatjss] Resolves: rhbz #871171,1058366
by Christina Fu
commit 384013eb504e369fce7bb346750dc9d9195390e9
Author: Christina Fu <cfu(a)redhat.com>
Date: Tue Sep 30 15:54:26 2014 -0700
Resolves: rhbz #871171,1058366
* Bugzilla Bug #871171 - Provide Tomcat support for TLS v1.1 and TLS v1.2 (Tomcatjss)
* Bugzilla Bug #1058366 - NullPointerException in tomcatjss searching for attribute "clientauth"
.gitignore | 1 +
sources | 2 +-
tomcatjss.spec | 25 ++++++++++++++++++++-----
3 files changed, 22 insertions(+), 6 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index ddf6197..be96159 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,4 @@ tomcatjss-1.2.0.tar.gz
/tomcatjss-6.0.2.tar.gz
/tomcatjss-7.0.0.tar.gz
/tomcatjss-7.1.0.tar.gz
+/tomcatjss-7.1.1.tar.gz
diff --git a/sources b/sources
index ab749d6..a382a9b 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-43566b6cd9249b4e861c5a1646de679b tomcatjss-7.1.0.tar.gz
+54d88b865e5e13cb2a4b3f6874a33cdb tomcatjss-7.1.1.tar.gz
diff --git a/tomcatjss.spec b/tomcatjss.spec
index 8c0c2de..48d8a28 100644
--- a/tomcatjss.spec
+++ b/tomcatjss.spec
@@ -1,6 +1,6 @@
Name: tomcatjss
-Version: 7.1.0
-Release: 6%{?dist}
+Version: 7.1.1
+Release: 1%{?dist}
Summary: JSSE implementation using JSS for Tomcat
URL: http://pki.fedoraproject.org/
License: LGPLv2+
@@ -17,12 +17,16 @@ Source0: http://pki.fedoraproject.org/pki/sources/%{name}/%{name}-%{version}.ta
BuildRequires: ant
BuildRequires: java-devel
BuildRequires: jpackage-utils >= 0:1.7.5-15
-BuildRequires: jss >= 4.2.6-24
+BuildRequires: jss >= 4.2.6-35
BuildRequires: tomcat >= 7.0.40
+%if 0%{?fedora} >= 21
Requires: java-headless
+%else
+Requires: java
+%endif
Requires: jpackage-utils >= 0:1.7.5-15
-Requires: jss >= 4.2.6-24
+Requires: jss >= 4.2.6-35
Requires: tomcat >= 7.0.40
# The 'tomcatjss' package conflicts with the 'tomcat-native' package
@@ -63,6 +67,10 @@ unzip %{name}-%{version}.zip -d %{buildroot}
# Install our files
cd %{buildroot}%{_javadir}
+%if 0%{?rhel} || 0%{?fedora} < 21
+mv %{name}.jar %{name}-%{version}.jar
+ln -s %{name}-%{version}.jar %{name}.jar
+%endif
%clean
rm -rf %{buildroot}
@@ -73,6 +81,13 @@ rm -rf %{buildroot}
%{_javadir}/*
%changelog
+* Tue Sep 30 2014 Christina Fu <cfu(a)redhat.com> 7.1.1-1
+- Bugzilla Bug #1058366 NullPointerException in tomcatjss searching
+ for attribute "clientauth" (cfu)
+- Bugzilla Bug #871171 - Provide Tomcat support for TLS v1.1 and
+ TLS v1.2 (cfu)
+- Bumped revision to 7.1.1
+
* Sun Jun 08 2014 Fedora Release Engineering <rel-eng(a)lists.fedoraproject.org> - 7.1.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
@@ -100,7 +115,7 @@ rm -rf %{buildroot}
- PKI TRAC Ticket #283 - Dogtag 10: Integrate Tomcat 6 'tomcatjss.jar' and
Tomcat 7 'tomcat7jss.jar' in Fedora 18 tomcatjss package
-* Wed Jul 26 2012 Matthew Harmsen <mharmsen(a)redhat.com> 7.0.0-2
+* Thu Jul 26 2012 Matthew Harmsen <mharmsen(a)redhat.com> 7.0.0-2
- Fixed runtime 'Requires' cut/paste typos
* Wed Jun 06 2012 Matthew Harmsen <mharmsen(a)redhat.com> 7.0.0-1
8Â years, 12Â months
[krb5/f20] * Tue Sep 30 2014 Roland Mainz <rmainz@redhat.com> - 1.11.5-16 - fix for CVE-2014-5351 (#1145425) "k
by Roland Mainz
commit d7b05a2badd3569153c53240a37e57e1def0be8a
Author: Roland Mainz <rmainz(a)redhat.com>
Date: Wed Oct 1 00:23:31 2014 +0200
* Tue Sep 30 2014 Roland Mainz <rmainz(a)redhat.com> - 1.11.5-16
- fix for CVE-2014-5351 (#1145425) "krb5: current keys returned when
randomizing the keys for a service principal"
krb5-11.1_CVE-2014-5351_001.patch | 86 +++++++++++++++++++++++++++++++++++++
krb5.spec | 9 +++-
2 files changed, 94 insertions(+), 1 deletions(-)
---
diff --git a/krb5-11.1_CVE-2014-5351_001.patch b/krb5-11.1_CVE-2014-5351_001.patch
new file mode 100644
index 0000000..793c93c
--- /dev/null
+++ b/krb5-11.1_CVE-2014-5351_001.patch
@@ -0,0 +1,86 @@
+From 3bf9e33f9d66c0eef486cbd83f9e4f13a74d12c3 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson(a)mit.edu>
+Date: Thu, 21 Aug 2014 13:52:07 -0400
+Subject: [PATCH] Return only new keys in randkey [CVE-2014-5351]
+
+In kadmind's randkey operation, if a client specifies the keepold
+flag, do not include the preserved old keys in the response.
+
+CVE-2014-5351:
+
+An authenticated remote attacker can retrieve the current keys for a
+service principal when generating a new set of keys for that
+principal. The attacker needs to be authenticated as a user who has
+the elevated privilege for randomizing the keys of other principals.
+
+Normally, when a Kerberos administrator randomizes the keys of a
+service principal, kadmind returns only the new keys. This prevents
+an administrator who lacks legitimate privileged access to a service
+from forging tickets to authenticate to that service. If the
+"keepold" flag to the kadmin randkey RPC operation is true, kadmind
+retains the old keys in the KDC database as intended, but also
+unexpectedly returns the old keys to the client, which exposes the
+service to ticket forgery attacks from the administrator.
+
+A mitigating factor is that legitimate clients of the affected service
+will start failing to authenticate to the service once they begin to
+receive service tickets encrypted in the new keys. The affected
+service will be unable to decrypt the newly issued tickets, possibly
+alerting the legitimate administrator of the affected service.
+
+CVSSv2: AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C
+
+[tlyu(a)mit.edu: CVE description and CVSS score]
+
+(cherry picked from commit af0ed4df4dfae762ab5fb605f5a0c8f59cb4f6ca)
+
+ticket: 8018
+version_fixed: 1.13
+status: resolved
+---
+diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
+index ae36841..dc8393f 100644
+--- a/src/lib/kadm5/srv/svr_principal.c
++++ b/src/lib/kadm5/srv/svr_principal.c
+@@ -331,6 +331,20 @@ check_1_6_dummy(kadm5_principal_ent_t entry, long mask,
+ *passptr = NULL;
+ }
+
++/* Return the number of keys with the newest kvno. Assumes that all key data
++ * with the newest kvno are at the front of the key data array. */
++static int
++count_new_keys(int n_key_data, krb5_key_data *key_data)
++{
++ int n;
++
++ for (n = 1; n < n_key_data; n++) {
++ if (key_data[n - 1].key_data_kvno != key_data[n].key_data_kvno)
++ return n;
++ }
++ return n_key_data;
++}
++
+ kadm5_ret_t
+ kadm5_create_principal(void *server_handle,
+ kadm5_principal_ent_t entry, long mask,
+@@ -1693,7 +1707,7 @@ kadm5_randkey_principal_3(void *server_handle,
+ osa_princ_ent_rec adb;
+ krb5_int32 now;
+ kadm5_policy_ent_rec pol;
+- int ret, last_pwd, have_pol = 0;
++ int ret, last_pwd, n_new_keys, have_pol = 0;
+ kadm5_server_handle_t handle = server_handle;
+ krb5_keyblock *act_mkey;
+ int new_n_ks_tuple = 0;
+@@ -1781,8 +1795,9 @@ kadm5_randkey_principal_3(void *server_handle,
+ kdb->fail_auth_count = 0;
+
+ if (keyblocks) {
+- ret = decrypt_key_data(handle->context,
+- kdb->n_key_data, kdb->key_data,
++ /* Return only the new keys added by krb5_dbe_crk. */
++ n_new_keys = count_new_keys(kdb->n_key_data, kdb->key_data);
++ ret = decrypt_key_data(handle->context, n_new_keys, kdb->key_data,
+ keyblocks, n_keys);
+ if (ret)
+ goto done;
diff --git a/krb5.spec b/krb5.spec
index d42868f..3b68763 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -41,7 +41,7 @@
Summary: The Kerberos network authentication system
Name: krb5
Version: 1.11.5
-Release: 15%{?dist}
+Release: 16%{?dist}
# Maybe we should explode from the now-available-to-everybody tarball instead?
# http://web.mit.edu/kerberos/dist/krb5/1.11/krb5-1.11.5-signed.tar
Source0: krb5-%{version}.tar.gz
@@ -159,6 +159,7 @@ Patch405: 0005-Copy-config-entries-to-the-ksu-target-ccache.patch
Patch406: 0006-Use-more-randomness-for-ksu-secondary-cache-names.patch
Patch407: 0007-Make-krb5_cc_new_unique-create-DIR-directories.patch
Patch408: krb5-1.11-base64-exports.patch
+Patch409: krb5-11.1_CVE-2014-5351_001.patch
License: MIT
URL: http://web.mit.edu/kerberos/www/
@@ -370,6 +371,8 @@ ln -s NOTICE LICENSE
%patch407 -p1 -b .Make-krb5_cc_new_unique-create-DIR-directories
%patch408 -p1 -b .base64-exports
+%patch409 -p1
+
%patch60 -p1 -b .pam
%patch63 -p1 -b .selinux-label
@@ -1109,6 +1112,10 @@ exit 0
%{_sbindir}/uuserver
%changelog
+* Tue Sep 30 2014 Roland Mainz <rmainz(a)redhat.com> - 1.11.5-16
+- fix for CVE-2014-5351 (#1145425) "krb5: current keys returned when
+ randomizing the keys for a service principal"
+
* Sat Sep 6 2014 Nalin Dahyabhai <nalin(a)redhat.com> - 1.11.5-15
- replace older proposed changes for ksu with backports of the changes
after review and merging upstream (#1015559, #1026099, #1118347)
8Â years, 12Â months