Merge munin 2.0.9-1 (main) from Debian experimental
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
munin (Ubuntu) |
Fix Released
|
Wishlist
|
Unassigned |
Bug Description
Please merge munin 2.0.9-1 (main) from Debian experimental
Explanation of the Ubuntu delta and why it can be dropped:
* SECURITY UPDATE: privilege escalation via root running plugins
- debian/
state directory in Makefile, Makefile.config,
node/
plugins/
- CVE-2012-3512
* SECURITY UPDATE: remote code exection via bad arguments
- debian/
instead of @ARGV to specify alternate config file in
master/
- debian/
MUNIN_
run by a cron job in plugins/
plugins/
- CVE-2012-3513
* debian/rules: actually apply quilt patches.
* debian/
* debian/
directory.
* debian/
- Fix occasional "Ran out of children: No child processes" error messages
(LP: #1009357).
* Merge from Debian unstable. Remaining changes:
- d/munin-
The security updates are in the new version.
The plugin state changes were applied I believe in 2.0.6-1 or -2.
The remaining diff is just the upstart files and the ran_out_of_children patch
Changelog entries since current raring version 2.0.2-1ubuntu3:
munin (2.0.9-1) experimental; urgency=low
* New upstream bugfix release(s).
- Drop all debian/patches/ (except 100-DejaVu-
were included in 2.0.7-2.0.9.
* Remove libcgi-fast-perl from munin's depends.
* Add libapache2-
* Support libapache2-
(Closes: #695228), remove configuration for libapache2-
non-free.
* debian/rules: set MUNIN_VERSION correctly during build. (Closes: #694527)
-- Holger Levsen <email address hidden> Tue, 11 Dec 2012 22:33:55 +0100
munin (2.0.6-2) UNRELEASED; urgency=low
* munin-node.
on purge. The plugin-state is outdated after a few minutes anyway.
(Closes: #687715)
* Fix "/etc/apache2/
- debian/
upgrades from versions where it was still removed (up to 1.4.6-3) but
not re-created (from 1.4.6-1 onwards). Thanks to Gregor Herrman for the
patch and intrigeri for reviewing. (Closes: #677943)
* Add documentation for munin-async, thanks to Daniel Black.
(Closes: #681803)
* Patch node/munin-
mostly to document that IPv6 addresses are allowed as well. Thanks to
Daniel Black. (Closes: #676798)
This is debian/
* HTMLConfig.pm: cherry-pick 789c59e from 2.0.7 to avoid (using the default
configuration) /var/log/
of noisy warnings (out of 112 lines in total) every 5min. (Closes: #689291)
This is debian/
* munin-doc: Break and replace munin-common << 2. (Closes: #694355)
* selinux_avcstat plugin: Do not use the "read without variable" bashism,
thanks to intrigeri for the patch. (Closes: #690711)
This is 240-Do-
* Have master support multi-homed nodes that only listen on IPv4.
(Closes: #678662) This is upstream commit a18229c5, thanks to Michael
Renner for the testing and the patch!
This is debian/
* Fix wrong assumption about Net::SSLeay:
Thanks to intrigeri for this patch. (Closes: #675377)
This is 242-Fix-
* http_loadtime plugin: fix stderr redirection (which broke the plugin
completely) (Closes: #691448)
This is 243-http_
* apt_all plugin: the apt_all plugin has its state updated in cron. There
the ENV var MUNIN_PLUGSTATE doesn't exist, so we need to set a default.
(Closes: #687495). This has been in included in 2.0.7 and is
debian/
* munin-async.init: Run munin-async after munin-node has been started.
(Closes: #691390) - Thanks to Daniel Black for this and the next two
fixes:
* munin-async.
from previous versions) and for new installs. (Closes: #691309)
* munin-async.
(Closes: #691758)
* Use dh --with quilt so that the patches are actually applied.
(Closes: #691327)
* Drop 101-suppress-
is included since munin 1.4.4.
-- Holger Levsen <email address hidden> Sat, 15 Sep 2012 14:02:44 +0200
munin (2.0.6-1) unstable; urgency=high
* New upstream release 2.0.6, switching back to cron graphing (as it better
for small setups) and besides that only containing bugfixes, but many of
them. See the upstream ChangeLog for the full list.
- munin-node: more secure state file handling, introducing a new plugin
state directory root, owned by uid 0. Then each plugin runs in its own
UID plugin state directory, owned by the said UID. (Closes: #684075),
(Closes: #679897), closes CVE-2012-3512.
So all properly written plugins will use
/
plugins that are still using /var/lib/
might pose a security risk!
- munin-cgi-graph: ignore @ARGV to fix CVE-2012-3513 (Closes: #684076),
thanks to Helmut Grohne <email address hidden>
- munin-cron: call munin-graph with --cron argument (Closes: #685343)
- Master/Node.pm: fix _node_read_fast() to accept all valid returns
(Closes: #686089) and _do_connect() to not use an uninitialized
variable. (Closes: #686090)
- munin-async: make spoolread less restrictive about (valid) plugin names
(Closes: #686093)
* Update Location and Scriptalias in shipped apache.conf to fix a regression
introduced in fixing #682869.
* munin-node.
munin-node now uses /var/lib/
handles creation by itself.
* debian/rules: workaround bug in upstream Makefile targets to move
/var/lib/async from munin-node package to munin-async.
* debian/control:
- make munin-async depend on munin-node for now.
- update Vcs: headers to point to an uptodate repository.
* Remove build/resources
* update munin.NEWS to reflect that everybody using cgi graphing needs to
update the configuration files and that cron graphing is the default
again. (cgi graphing was the default from pre-2.0 until 2.0.5)
-- Holger Levsen <email address hidden> Mon, 03 Sep 2012 12:42:09 +0000
munin (2.0.5-1) unstable; urgency=low
[ Holger Levsen ]
* New upstream versions, fixing lots of bugs (including a regression in
munin-cgi-graph preventing it from caching at all (Closes: #683064))
and adding documentation and manpages. See upstream ChangeLog for the
full list.
* Remove workaround concerning java-plugins (667493) in debian/rules
as upstream has fixed this in e7e29c4 in 2.0.3.
* munin-async.init:
- run munin-async as munin-async user (Closes: #684171)
- use stop function from munin-node.init to make it actually stop it
(Closes: #684170). In the future we should replace both initscripts with
saner rewrites.
[ Helmut Grohne ]
* Move cgi scripts to /usr/lib/munin/cgi. (Closes: #682869)
-- Holger Levsen <email address hidden> Tue, 14 Aug 2012 19:12:54 +0200
remaining diff with Debian