[SECURITY] Fedora EPEL 6 Update: tomcat-7.0.85-1.el6
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-f5cd94db4e
2018-04-05 11:42:30.642347
--------------------------------------------------------------------------------
Name : tomcat
Product : Fedora EPEL 6
Version : 7.0.85
Release : 1.el6
URL : http://tomcat.apache.org/
Summary : Apache Servlet/JSP Engine, RI for Servlet 3.0/JSP 2.2 API
Description :
Tomcat is the servlet container that is used in the official Reference
Implementation for the Java Servlet and JavaServer Pages technologies.
The Java Servlet and JavaServer Pages specifications are developed by
Sun under the Java Community Process.
Tomcat is developed in an open and participatory environment and
released under the Apache Software License version 2.0. Tomcat is intended
to be a collaboration of the best-of-breed developers from around the world.
--------------------------------------------------------------------------------
Update Information:
This update includes a rebase from 7.0.84 up to 7.0.85 which resolves two CVEs
along with various other bugs/features: * rhbz#1548291 CVE-2018-1304 tomcat:
Incorrect handling of empty string URL in security constraints can lead to
unitended exposure of resources * rhbz#1548283 CVE-2018-1305 tomcat: Late
application of security constraints can lead to resource exposure for
unauthorised users
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update tomcat' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years
Fedora EPEL 6 Update: perl-Authen-Radius-0.24-1.el6
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-648849bf40
2018-04-05 11:42:30.642284
--------------------------------------------------------------------------------
Name : perl-Authen-Radius
Product : Fedora EPEL 6
Version : 0.24
Release : 1.el6
URL : http://search.cpan.org/dist/RadiusPerl/
Summary : Provide simple Radius client facilities
Description :
The Authen::Radius module provides a simple class that allows you to
send/receive Radius requests/responses to/from a Radius server.
You can just authenticate usernames/passwords via Radius, or completely
imitate AAA requests and process server responses.
--------------------------------------------------------------------------------
Update Information:
This is the first EPEL-6 build of perl-Authen-Radius.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1557561 - Please add: perl-Authen-Radius to EPEL 6
https://bugzilla.redhat.com/show_bug.cgi?id=1557561
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update perl-Authen-Radius' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years
Fedora EPEL 7 Update: devilspie2-0.43-1.el7
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-4a284621c8
2018-04-04 19:10:53.814052
--------------------------------------------------------------------------------
Name : devilspie2
Product : Fedora EPEL 7
Version : 0.43
Release : 1.el7
URL : http://www.nongnu.org/devilspie2/
Summary : A window-matching utility
Description :
Devilspie2 is a window matching utility, allowing the user to perform scripted
actions on windows as they are created. For example you can script a terminal
program to always be positioned at a specific screen position, or position a
window on a specific workspace. It is based on the program Devilspie by Ross
Burton.
--------------------------------------------------------------------------------
Update Information:
New upstream version. ---- New upstream version.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1557021 - devilspie2-0.43 is available
https://bugzilla.redhat.com/show_bug.cgi?id=1557021
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update devilspie2' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years
Fedora EPEL 7 Update: wt-3.3.9-1.el7
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-fa01787389
2018-04-04 19:10:53.813992
--------------------------------------------------------------------------------
Name : wt
Product : Fedora EPEL 7
Version : 3.3.9
Release : 1.el7
URL : https://www.webtoolkit.eu/wt
Summary : C++ library for developing web applications
Description :
Web C++ library with widget oriented API that uses well-tested patterns of
desktop GUI development tailored to the web. To the developer, it offers
abstraction of web-specific implementation details, including client-server
protocols, event handling, graphics support, graceful degradation (or
progressive enhancement), and URL handling.
--------------------------------------------------------------------------------
Update Information:
Initial epel release
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1431791 - This package is not available on EPEL 7
https://bugzilla.redhat.com/show_bug.cgi?id=1431791
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update wt' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years
Fedora EPEL 6 Update: rho-0.0.33-1.el6
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-6b3e536911
2018-04-03 16:32:02.113070
--------------------------------------------------------------------------------
Name : rho
Product : Fedora EPEL 6
Version : 0.0.33
Release : 1.el6
URL : http://github.com/quipucords/rho
Summary : An SSH system profiler
Description :
Rho is a tool for scanning your network, logging into systems via SSH, and
retrieving information about them.
--------------------------------------------------------------------------------
Update Information:
# Testing Rho To set up Rho, you create profiles that control how to run each
scan. - Authentication profiles contain user credentials for a user with
sufficient authority to complete the scan (for example, a root user or one with
root-level access obtained through -sudo privilege escalation). - Network
profiles contain network identifiers (for example, a hostname, IP address, or
range of IP addresses) and the authentication profiles to be used for a scan.
Complete the following steps, repeating them as necessary to access all parts of
your environment that you want to scan: 1. Create at least one authentication
profile with root-level access to Rho: ``` rho auth add --name auth_name
--username root_name(--sshkeyfile key_file | --password) ``` a. At the Rho
vault password prompt, create a new Rho vault password. This password is
required to access the encrypted Rho data, such as authentication and network
profiles, scan data, and other information. b. If you did not use the
sshkeyfile option to provide an SSH key for the username value, enter the
password of the user with root-level access at the connection password prompt.
For example, for an authentication profile where the authentication profile name
is roothost1, the user with root-level access is root, and the SSH key for the
user is in the path ~/.ssh/id_rsa, you would enter the following command: ```
rho auth add --name roothost1 --username root --sshkeyfile ~/.ssh/id_rsa ``` You
can also use the sudo-password option to create an authentication profile for a
user with root-level access who requires a password to obtain this privilege.
You can use the sudo-password option with either the sshkeyfile or the password
option. For example, for an authentication profile where the authentication
profile name is sudouser1, the user with root-level access is sysadmin, and the
access is obtained through the password option, you would enter the following
command: ``` rho auth add --name sudouser1 --username sysadmin --password
--sudo-password ``` After you enter this command, you are prompted to enter two
passwords. First, you would enter the connection password for the username user,
and then you would enter the password for the sudo command. 2. Create at least
one network profile that specifies one or more network identifiers, such as a
host name, an IP address, a list of IP addresses, or an IP range, and one or
more authentication profiles to be used for the scan: ``` rho profile add --name
profile_name --hosts host_name_or_file --auth auth_name ``` For example, for a
network profile where the name of the network profile is mynetwork, the network
to be scanned is the 192.0.2.0/24 subnet, and the authentication profiles that
are used to run the scan are roothost1 and roothost2, you would enter the
following command: ``` rho profile add --name mynetwork --hosts 192.0.2.[1:254]
--auth roothost1 roothost2 ``` You can also use a file to pass in the network
identifiers. If you use a file to enter multiple network identifiers, such as
multiple individual IP addresses, enter each on a single line. For example, for
a network profile where the path to this file is /home/user1/hosts_file, you
would enter the following command: ``` rho profile add --name mynetwork --hosts
/home/user1/hosts_file --auth roothost1 roothost2 ``` # Running a scan Run the
scan by using the scan command, specifying a network profile for the profile
option and a location to store the output as a file in the comma-separated
variables (CSV) format for the reportfile option: ``` rho scan --profile
profile_name --reportfile filename.csv ``` For example, if you want to use the
network profile mynetwork and save the report as mynetwork_scan1.csv, you would
enter the following command: ``` rho scan --profile mynetwork --reportfile
mynetwork_scan1.csv ```
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update rho' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years
Fedora EPEL 7 Update: rho-0.0.33-1.el7
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-191a89bd01
2018-04-03 14:01:46.495759
--------------------------------------------------------------------------------
Name : rho
Product : Fedora EPEL 7
Version : 0.0.33
Release : 1.el7
URL : http://github.com/quipucords/rho
Summary : An SSH system profiler
Description :
Rho is a tool for scanning your network, logging into systems via SSH, and
retrieving information about them.
--------------------------------------------------------------------------------
Update Information:
# Testing Rho To set up Rho, you create profiles that control how to run each
scan. - Authentication profiles contain user credentials for a user with
sufficient authority to complete the scan (for example, a root user or one with
root-level access obtained through -sudo privilege escalation). - Network
profiles contain network identifiers (for example, a hostname, IP address, or
range of IP addresses) and the authentication profiles to be used for a scan.
Complete the following steps, repeating them as necessary to access all parts of
your environment that you want to scan: 1. Create at least one authentication
profile with root-level access to Rho: ``` rho auth add --name auth_name
--username root_name(--sshkeyfile key_file | --password) ``` a. At the Rho
vault password prompt, create a new Rho vault password. This password is
required to access the encrypted Rho data, such as authentication and network
profiles, scan data, and other information. b. If you did not use the
sshkeyfile option to provide an SSH key for the username value, enter the
password of the user with root-level access at the connection password prompt.
For example, for an authentication profile where the authentication profile name
is roothost1, the user with root-level access is root, and the SSH key for the
user is in the path ~/.ssh/id_rsa, you would enter the following command: ```
rho auth add --name roothost1 --username root --sshkeyfile ~/.ssh/id_rsa ``` You
can also use the sudo-password option to create an authentication profile for a
user with root-level access who requires a password to obtain this privilege.
You can use the sudo-password option with either the sshkeyfile or the password
option. For example, for an authentication profile where the authentication
profile name is sudouser1, the user with root-level access is sysadmin, and the
access is obtained through the password option, you would enter the following
command: ``` rho auth add --name sudouser1 --username sysadmin --password
--sudo-password ``` After you enter this command, you are prompted to enter two
passwords. First, you would enter the connection password for the username user,
and then you would enter the password for the sudo command. 2. Create at least
one network profile that specifies one or more network identifiers, such as a
host name, an IP address, a list of IP addresses, or an IP range, and one or
more authentication profiles to be used for the scan: ``` rho profile add --name
profile_name --hosts host_name_or_file --auth auth_name ``` For example, for a
network profile where the name of the network profile is mynetwork, the network
to be scanned is the 192.0.2.0/24 subnet, and the authentication profiles that
are used to run the scan are roothost1 and roothost2, you would enter the
following command: ``` rho profile add --name mynetwork --hosts 192.0.2.[1:254]
--auth roothost1 roothost2 ``` You can also use a file to pass in the network
identifiers. If you use a file to enter multiple network identifiers, such as
multiple individual IP addresses, enter each on a single line. For example, for
a network profile where the path to this file is /home/user1/hosts_file, you
would enter the following command: ``` rho profile add --name mynetwork --hosts
/home/user1/hosts_file --auth roothost1 roothost2 ``` # Running a scan Run the
scan by using the scan command, specifying a network profile for the profile
option and a location to store the output as a file in the comma-separated
variables (CSV) format for the reportfile option: ``` rho scan --profile
profile_name --reportfile filename.csv ``` For example, if you want to use the
network profile mynetwork and save the report as mynetwork_scan1.csv, you would
enter the following command: ``` rho scan --profile mynetwork --reportfile
mynetwork_scan1.csv ```
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update rho' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years
[SECURITY] Fedora EPEL 7 Update: glpi-0.90.5-2.el7
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-ae3a1eae7e
2018-04-03 14:01:46.495736
--------------------------------------------------------------------------------
Name : glpi
Product : Fedora EPEL 7
Version : 0.90.5
Release : 2.el7
URL : http://www.glpi-project.org/
Summary : Free IT asset management software
Description :
GLPI is the Information Resource-Manager with an additional Administration-
Interface. You can use it to build up a database with an inventory for your
company (computer, software, printers...). It has enhanced functions to make
the daily life for the administrators easier, like a job-tracking-system with
mail-notification and methods to build a database with basic information
about your network-topology.
--------------------------------------------------------------------------------
Update Information:
escape get keys to prevent possible xss CVE-2018-7563
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1554755 - CVE-2018-7563 glpi: XSS vulnerability in the query string to front/preference.php
https://bugzilla.redhat.com/show_bug.cgi?id=1554755
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update glpi' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years
Fedora EPEL 7 Update: pdc-updater-0.8.4-2.el7
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-f7e0237724
2018-04-03 14:01:46.495713
--------------------------------------------------------------------------------
Name : pdc-updater
Product : Fedora EPEL 7
Version : 0.8.4
Release : 2.el7
URL : https://pypi.io/project/pdc-updater
Summary : Update the product definition center in response to fedmsg
Description :
Fedmsg consumer that listens to activity on the Fedora message bus, and updates
the Product Definition Center database in response.
--------------------------------------------------------------------------------
Update Information:
Latest upstream. ---- Latest upstream.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update pdc-updater' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years
Fedora EPEL 7 Update: kabi-dw-0-0.6.20180308gitb8863d0.el7
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-985261c784
2018-04-03 14:01:46.495690
--------------------------------------------------------------------------------
Name : kabi-dw
Product : Fedora EPEL 7
Version : 0
Release : 0.6.20180308gitb8863d0.el7
URL : https://github.com/skozina/kabi-dw
Summary : Detect changes in the ABI between kernel builds
Description :
The aim of kabi-dw is to detect any changes in the ABI between the successive
builds of the Linux kernel. This is done by dumping the DWARF type information
(the .debug_info section) for the specific symbols into the text files and
later comparing the text files.
--------------------------------------------------------------------------------
Update Information:
Update to upstream b8863d05565e91bd3fb40d9e9d562be081f09669 and fix build flags
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update kabi-dw' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years
Fedora EPEL 7 Update: datagrepper-0.9.3-1.el7
by updates＠fedoraproject.org
--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-5a36ac4246
2018-04-03 14:01:46.495666
--------------------------------------------------------------------------------
Name : datagrepper
Product : Fedora EPEL 7
Version : 0.9.3
Release : 1.el7
URL : https://github.com/fedora-infra/datagrepper
Summary : A webapp to query fedmsg history
Description :
A webapp to retrieve historical information about messages on the fedmsg
bus. It is a JSON api for the datanommer message store.
--------------------------------------------------------------------------------
Update Information:
Fix a [500 error](https://http.cat/500) when using `contains`. ---- Latest
upstream.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update datagrepper' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/...
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
6 years