Freeze Break Request: Ipsilon CVE update

[Patrick Uiterwijk]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

Can I get +1s to apply the fix for CVE-2015-5301 in production?
RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1271530

While this bug has less impact for us as SP's cannot be deleted
permanently (because we use file-based configuration), the SP will
be removed from the in-memory config state, meaning that until
httpd is restarted it will be gone.

- -- 
With kind regards,
Patrick Uiterwijk
Fedora Infra
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBCgAGBQJWHlt9AAoJEIZXmA2atR5QuF0P/11iKPQpPHc1NcUcJxmRzPv2
> 7E/uXSqiQqWlaSV3N4k40Eemj2K8e2gSNhH+jbGWGfMbVGh4bV+me9blWlTY/RJI
> S1vdKmwnRSf3EkJ0g2LqfbFShX+CZgwUWAL8G2JIgBogVHZP105kjDqUd1GWlelw
> 0160eDxFPZ4XYPS9ylhbV/Mod9pCKKyynXbnH8P8wCvhG+l7vj2wzYVjCW8Gk1P9
> H8MTDlCgY+HLOXtFGhMotn7DzsF5PyHEMfk418y9DVGiD6mdbeLppkdKFrc3GwZP
> W6ZV0HSKxldGQ8OtWMB36FngGTfWanHr2wabgMVAzA4+b+p1nPiPaKzuak2TatqU
> mQIBBx9TMM+9cnv4W8/hgnjF1lV+9fiGofdIUJj0WbECtwntRz75WWCn65Dg6UlC
> tJHM3V2GfABkiUA76J7l5AU9G0AcA47gF2rRAdzDb/VcPmPZZcZ6vmpJtkvScwOw
> NiKf/iEKYUOZcU3Xx97FtqITQ0CTfyHN+3ECMYtYPWD1ZBq6DzxQhrxLlU51nons
> 0D1GGVyC6Ij+Su/CF5Ugb9SRDfKyfUcMRYih/WYk/LFdU0z5V48uQiFB/LfHIPAu
> dZAKrsozDA46nsO6o3ghPcBTJARR7ycknEyOIuaDOr5hvJKe2ZNv1QIyaG9ha/K0
> Afur0fVHvWElEQYhkPIW
> =fnR8
> -----END PGP SIGNATURE-----

[Dennis Gilmore]

On Wednesday, October 14, 2015 03:41:17 PM Patrick Uiterwijk wrote:
> Hi,
>
> Can I get +1s to apply the fix for CVE-2015-5301 in production?
> RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1271530
>
> While this bug has less impact for us as SP's cannot be deleted
> permanently (because we use file-based configuration), the SP will
> be removed from the in-memory config state, meaning that until
> httpd is restarted it will be gone.

+1
I think this is something you can do and get retrospective +1's for

Dennis

[Patrick Uiterwijk]

Fair enough.
I just deployed this patch in stg and prod.
Can I get a retrospective +1?

With kind regards,
Patrick Uiterwijk
Fedora Infra

----- Original Message -----
> On Wednesday, October 14, 2015 03:41:17 PM Patrick Uiterwijk wrote:
> > Hi,
> >
> > Can I get +1s to apply the fix for CVE-2015-5301 in production?
> > RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1271530
> >
> > While this bug has less impact for us as SP's cannot be deleted
> > permanently (because we use file-based configuration), the SP will
> > be removed from the in-memory config state, meaning that until
> > httpd is restarted it will be gone.
>
> +1
> I think this is something you can do and get retrospective +1's for
>
> Dennis
> _______________________________________________
> infrastructure mailing list
> [e-mail]
> http://lists.fedoraproject.org/admin/[e-mail]

[Pierre-Yves Chibon]

On Wed, Oct 14, 2015 at 03:41:17PM +0200, Patrick Uiterwijk wrote:
> Hi,
>
> Can I get +1s to apply the fix for CVE-2015-5301 in production?
> RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1271530
>
> While this bug has less impact for us as SP's cannot be deleted
> permanently (because we use file-based configuration), the SP will
> be removed from the in-memory config state, meaning that until
> httpd is restarted it will be gone.

+1 as well

Pierre