[SECURITY] Fedora 27 Update: uwsgi-2.0.17.1-1.fc27

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2018-04b3af1edf
2018-07-20 16:57:33.327523
--------------------------------------------------------------------------------

Name        : uwsgi
Product     : Fedora 27
Version     : 2.0.17.1
Release     : 1.fc27
URL         : https://github.com/unbit/uwsgi
Summary     : Fast, self-healing, application container server
Description :
uWSGI is a fast (pure C), self-healing, developer/sysadmin-friendly
application container server.  Born as a WSGI-only server, over time it has
evolved in a complete stack for networked/clustered web applications,
implementing message/object passing, caching, RPC and process management.
It uses the uwsgi (all lowercase, already included by default in the Nginx
and Cherokee releases) protocol for all the networking/interprocess
communications.  Can be run in preforking mode, threaded,
asynchronous/evented and supports various form of green threads/co-routine
(like uGreen and Fiber).  Sysadmin will love it as it can be configured via
command line, environment variables, xml, .ini and yaml files and via LDAP.
Being fully modular can use tons of different technology on top of the same
core.

--------------------------------------------------------------------------------
Update Information:

- Conditionally disable router-access for tcp_wrappers deprecation (Jorge
Gallegos) - Updated to 2.0.16 which includes fix for CVE-2018-6758 (Jorge
Gallegos)  ---  - Modernize and generalize building of Python subpackages:   -
replace python with python2   - use appropriate macros for when refering to
Python 3   - prefix Python-dependent plugins with the version of Python they are
built     with - Also build Python 3 subpackages for the other Python 3 version
in EPEL7  ---  - Build Python 3 version(s) of gevent plugin on Fedora and EPEL7
- Build Python 3 version of greenlet plugin on Fedora and EPEL7 - Build Python 2
version of greenlet plugin on EPEL7 - Always build Python 3 version of tornado
plugin when building with Python 3   (drop python3_tornado build conditional)
---  - Latest upstream (rhbz#1549354) - Enable uwsgi-plugin-coroae on EL7 - Use
systemd tmpfiles to create /run/uwsgi with group write permissions
(rhbz#1427303) - Use /var/run/uwsgi when not using systemd - Build with
versioned python command - Remove %%config from systemd unit file - Disable
greenlet plugin on EL7
--------------------------------------------------------------------------------
ChangeLog:

* Mon Jul  9 2018 Carl George <carl(a)george.computer&gt; - 2.0.17.1-1
- Latest upstream (rhbz#1549354)
- Enable uwsgi-plugin-coroae on EL7
- Use systemd tmpfiles to create /run/uwsgi with group write permissions (rhbz#1427303)
- Use /var/run/uwsgi when not using systemd
- Build with versioned python command
- Remove %config from systemd unit file
- Disable greenlet plugin on EL7
* Tue Jul  3 2018 Petr Pisar <ppisar(a)redhat.com&gt; - 2.0.16-7
- Perl 5.28 rebuild
* Fri Jun 29 2018 Jitka Plesnikova <jplesnik(a)redhat.com&gt; - 2.0.16-6
- Perl 5.28 rebuild
* Wed Jun 27 2018 Tadej Jane�� <tadej.j(a)nez.si&gt; - 2.0.16-5
- Build Python 3 version(s) of gevent plugin on Fedora and EPEL7
- Build Python 3 version of greenlet plugin on Fedora and EPEL7
- Build Python 2 version of greenlet plugin on EPEL7
- Always build Python 3 version of tornado plugin when building with Python 3
  (drop python3_tornado build conditional)
* Tue Jun 26 2018 Tadej Jane�� <tadej.j(a)nez.si&gt; - 2.0.16-4
- Modernize and generalize building of Python subpackages:
  - replace python with python2
  - use appropriate macros for when refering to Python 3
  - prefix Python-dependent plugins with the version of Python they are built
    with
- Also build Python 3 subpackages for the other Python 3 version in EPEL7
* Tue Jun 19 2018 Miro Hron��ok <mhroncok(a)redhat.com&gt; - 2.0.16-3
- Rebuilt for Python 3.7
* Tue Apr  3 2018 Till Maas <opensource(a)till.name&gt; - 2.0.16-2
- Fix building in Rawhide (#1556525) (Jakub Jelen)
- Disable tcp_wrappers for Fedora 28 and newer (Jakub Jelen)
* Tue Feb 13 2018 Jorge A Gallegos <kad(a)blegh.net&gt; - 2.0.16-1
- Conditionally disable router-access for tcp_wrappers deprecation (Jorge Gallegos)
- Updated to 2.0.16 which includes fix for CVE-2018-6758 (Jorge Gallegos)
* Fri Feb  9 2018 Fedora Release Engineering <releng(a)fedoraproject.org&gt; - 2.0.15-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Sat Jan 20 2018 Bj��rn Esser <besser82(a)fedoraproject.org&gt; - 2.0.15-8
- Rebuilt for switch to libxcrypt
* Tue Oct  3 2017 Remi Collet <remi(a)fedoraproject.org&gt; - 2.0.15-7
- rebuild for https://fedoraproject.org/wiki/Changes/php72
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1427303 - Add group write permission to socket directory
        https://bugzilla.redhat.com/show_bug.cgi?id=1427303
  [ 2 ] Bug #1549438 - CVE-2018-7490 uWSGI: Mishandled DOCUMENT_ROOT check with use of
--php-docroot option allows for directory traversal [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=1549438
  [ 3 ] Bug #1549354 - uwsgi-2.0.17.1 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=1549354
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2018-04b3af1edf' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------