The following Fedora EPEL 5 Security updates need testing:
Age URL
700
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2014-1626 puppet-2.7.26-1.el5
550
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2014-3849
sblim-sfcb-1.3.8-2.el5
193
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-edbea40516
mcollective-2.8.4-1.el5
164
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-582c8075e6
thttpd-2.25b-24.el5
57
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-bafacd5846
proftpd-1.3.3g-5.el5
14
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-5a99f2af94
git-1.8.2.3-1.el5
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-795c3bc035
openvpn-2.3.11-1.el5
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-4dc85e79a3
wordpress-4.5.2-1.el5
0
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-92e8b90065
openssl101e-1.0.1e-8.el5
The following builds have been pushed to Fedora EPEL 5 updates-testing
dpm-dsi-1.9.7-5.el5
globus-authz-3.12-1.el5
globus-callout-3.14-1.el5
globus-common-16.4-1.el5
globus-ftp-client-8.29-1.el5
globus-ftp-control-6.10-1.el5
globus-gass-cache-9.8-1.el5
globus-gass-copy-9.19-1.el5
globus-gram-client-13.13-1.el5
globus-gram-client-tools-11.8-1.el5
globus-gridftp-server-10.2-1.el5
globus-gridftp-server-control-4.1-1.el5
globus-gridmap-eppn-callout-1.11-1.el5
globus-gsi-cert-utils-9.12-1.el5
globus-gssapi-gsi-12.1-1.el5
globus-io-11.5-1.el5
globus-net-manager-0.15-1.el5
globus-xio-5.12-1.el5
globus-xio-gridftp-driver-2.13-1.el5
globus-xio-gsi-driver-3.10-1.el5
globus-xio-pipe-driver-3.8-1.el5
myproxy-6.1.18-1.el5
openssl101e-1.0.1e-8.el5
Details about builds:
================================================================================
dpm-dsi-1.9.7-5.el5 (FEDORA-EPEL-2016-9dd192343d)
Disk Pool Manager (DPM) plugin for the Globus GridFTP server
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-authz-3.12-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus authz library
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-callout-3.14-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus Callout Library
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-common-16.4-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Common Library
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-ftp-client-8.29-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - GridFTP Client Library
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-ftp-control-6.10-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - GridFTP Control Library
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-gass-cache-9.8-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus Gass Cache
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-gass-copy-9.19-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus Gass Copy
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-gram-client-13.13-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - GRAM Client Library
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-gram-client-tools-11.8-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Job Management Tools (globusrun)
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-gridftp-server-10.2-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus GridFTP Server
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-gridftp-server-control-4.1-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus GridFTP Server Library
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-gridmap-eppn-callout-1.11-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus gridmap ePPN callout
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-gsi-cert-utils-9.12-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus GSI Cert Utils Library
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-gssapi-gsi-12.1-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - GSSAPI library
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-io-11.5-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - uniform I/O interface
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-net-manager-0.15-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Network Manager
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-xio-5.12-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus XIO Framework
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-xio-gridftp-driver-2.13-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus XIO GridFTP Driver
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-xio-gsi-driver-3.10-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus XIO GSI Driver
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
globus-xio-pipe-driver-3.8-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Globus Toolkit - Globus Pipe Driver
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
myproxy-6.1.18-1.el5 (FEDORA-EPEL-2016-9dd192343d)
Manage X.509 Public Key Infrastructure (PKI) security credentials
--------------------------------------------------------------------------------
Update Information:
globus-common: - Spelling corrections globus-gass-cache: - Spelling
corrections globus-gram-client-tools - Spelling corrections globus-gridftp-
server: - Spelling corrections (10.2) - Updates for https support (10.0) - Fix
crash when storattr is used without modify (9.7) - Add SITE WHOAMI command to
return currently authenticated user (9.6) - Update manpage for -encrypt-data
(9.5) globus-gridftp-server-control: - Spelling corrections globus-gridmap-
eppn-callout: - Missing dependency - Drop patch globus-gridmap-eppn-callout-
deps.patch (fixed upstream) globus-gsi-cert-utils: - Spelling corrections
globus-gssapi-gsi: - Change default host verification mode to strict - Add
support for certificates without a CN globus-io: - Fix uninitialized variable
reads and some warnings in io tests globus-xio-gsi-driver: - Propagate error
back to caller when name mismatch occurs on server instead of just closing the
handle dpm-dsi: - Rebuilt for globus-gridftp-server 10.2 myproxy: - Spelling
corrections
--------------------------------------------------------------------------------
================================================================================
openssl101e-1.0.1e-8.el5 (FEDORA-EPEL-2016-92e8b90065)
A general purpose cryptography library with TLS implementation
--------------------------------------------------------------------------------
Update Information:
OpenSSL ======= Security Fixes -------------- * A flaw was found in the way
OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw
to create a specially crafted certificate which, when verified or re-encoded by
OpenSSL, could cause it to crash, or execute arbitrary code using the
permissions of the user running an application compiled against the OpenSSL
library. (CVE-2016-2108) * Two integer overflow flaws, leading to buffer
overflows, were found in the way the EVP_EncodeUpdate() and EVP_EncryptUpdate()
functions of OpenSSL parsed very large amounts of input data. A remote attacker
could use these flaws to crash an application using OpenSSL or, possibly,
execute arbitrary code with the permissions of the user running that
application. (CVE-2016-2105, CVE-2016-2106) * It was discovered that OpenSSL
leaked timing information when decrypting TLS/SSL and DTLS protocol encrypted
records when the connection used the AES CBC cipher suite and the server
supported AES-NI. A remote attacker could possibly use this flaw to retrieve
plain text from encrypted packets by using a TLS/SSL or DTLS server as a padding
oracle. (CVE-2016-2107) * Several flaws were found in the way BIO_*printf
functions were implemented in OpenSSL. Applications which passed large amounts
of untrusted data through these functions could crash or potentially execute
code with the permissions of the user running such an application.
(CVE-2016-0799, CVE-2016-2842) * A denial of service flaw was found in the way
OpenSSL parsed certain ASN.1-encoded data from BIO (OpenSSL's I/O abstraction)
inputs. An application using OpenSSL that accepts untrusted ASN.1 BIO input
could be forced to allocate an excessive amount of data. (CVE-2016-2109) Bug
Fixes --------- * Previously, the ciphers(1) manual page did not describe the
following Elliptic Curve Cryptography (ECC) cipher suite groups: Elliptic Curve
Diffie���Hellman (ECDH) and Elliptic Curve Digital Signature Algorithm (ECDSA), or
TLS version 1.2 (TLSv1.2) specific features. This update adds the missing
description of the ECDH and ECDSA cipher groups and TLSv1.2 features to
ciphers(1), and the documentation is now complete. (BZ#1119191) * The server-
side renegotiation support did previously not work as expected under certain
circumstances. A PostgreSQL failure of database dumps through TLS connection
could occur when the size of the dumped data was larger than the value defined
in the ssl_renegotiation_limit setting. The regression that caused this bug has
been fixed, and the PostgreSQL database dumps through TLS connection no longer
fail in the described situation. (BZ#1234487) Enhancement ----------- * This
update adds the "-keytab" option to the "openssl s_server" command and
the
"-krb5svc" option to the "openssl s_server" and "openssl
s_client" commands. The
"-keytab" option allows the user to specify a custom keytab location; if the
user does not add "-keytab", the openssl utility assumes the default keytab
location. The "-krb5svc" option enables selecting a service other than the
"host" service; this allows unprivileged users without keys to the host
principal to use "openssl s_server" and "open s_client" with
Kerberos.
(BZ#961965)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1312219 - CVE-2016-0799 OpenSSL: Fix memory issues in BIO_*printf functions
https://bugzilla.redhat.com/show_bug.cgi?id=1312219
[ 2 ] Bug #1331536 - CVE-2016-2106 openssl: EVP_EncryptUpdate overflow
https://bugzilla.redhat.com/show_bug.cgi?id=1331536
[ 3 ] Bug #1331441 - CVE-2016-2105 openssl: EVP_EncodeUpdate overflow
https://bugzilla.redhat.com/show_bug.cgi?id=1331441
[ 4 ] Bug #1331426 - CVE-2016-2107 openssl: Padding oracle in AES-NI CBC MAC check
https://bugzilla.redhat.com/show_bug.cgi?id=1331426
[ 5 ] Bug #1331402 - CVE-2016-2108 openssl: Memory corruption in the ASN.1 encoder
https://bugzilla.redhat.com/show_bug.cgi?id=1331402
[ 6 ] Bug #1330101 - CVE-2016-2109 openssl: ASN.1 BIO handling of large amounts of data
https://bugzilla.redhat.com/show_bug.cgi?id=1330101
--------------------------------------------------------------------------------