Comment 9 for bug 1849205
Revision history for this message
| OpenStack Infra (hudson-openstack) wrote Fix merged to tools (f/centos8) | #9 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
35a32c5
(Get the code!)
Reviewed: https:/
Committed: https:/
Submitter: Zuul
Branch: f/centos8
commit 063e29fe2e12a30
Author: VictorRodriguez <email address hidden>
Date: Wed Nov 27 17:39:51 2019 -0600
Add feature to check if a CVE has an open launchpad
This change enables the capability to track if a CVE to be fixed already
has an open launchpad in starlingx: https:/
This will help the security team to focus on the CVEs that do not
have a launchpad already open, reducing the overhead of analysis of CVEs
already presented to the development team.
Story:2006971
Change-Id: I494f0221cb52a4
Signed-off-by: VictorRodriguez <email address hidden>
commit 1d33f5ae60201a6
Author: Robin Lu <email address hidden>
Date: Mon Nov 11 16:47:49 2019 +0800
Update OVMF rpm, due to CVE bug.
CVE bug: CVE-2019-0160
The updated rpm is selected from the below link.
https:/
Tests:
simplex, duplex, multi-node
Closes-Bug: 1849205
Change-Id: Ifdbbd82de91248
Signed-off-by: Robin Lu <email address hidden>
commit d964e258beb0c75
Author: Jim Somerville <email address hidden>
Date: Mon Nov 25 15:51:29 2019 -0500
Uprev ntp to version 4.2.6p5-29.el7
This solves:
ntp: Stack-based buffer overflow in ntpq and ntpdc allows
denial of service or code execution (CVE-2018-12327)
See the announcement link:
https:/
for more details.
Change-Id: Ic92fd6af30bf05
Partial-Bug: 1849197
Signed-off-by: Jim Somerville <email address hidden>
commit c75164899fb0d24
Author: Robin Lu <email address hidden>
Date: Fri Nov 22 16:08:13 2019 +0800
Update sudo srpm for CVE bug
To fix below CVE, we will use sudo-1.
https:/
CVE bug: CVE-2019-14287: sudo: can bypass certain policy blacklists
Closes-Bug: 1852825
Change-Id: Iaafc053fe6e3b5
Signed-off-by: Robin Lu <email address hidden>
commit ea25ae6f265f6a9
Author: Jim Somerville <email address hidden>
Date: Fri Nov 22 16:35:45 2019 -0500
Uprev ruby and associated gems to subminor ver 36
All affected packages are moved forward to their -36 version.
This solves:
ruby: Unintentional directory traversal by poisoned NULL byte
in Dir (CVE-2018-8780)
rubygems: Improper verification of signatures in tarball
allows to install mis-signed gem (CVE-2018-1000076)
along with numerous other issues.
See the announcement link:
https:/
for more details.
Note that rubygem-json is moved back to version 1.7.7-36 as it
should never have been moved to 2.0.2-2 in the first place. That
appears to have occurred accidentally, taking the package from
opstools instead of os when moving to CentOS 7.6.
Change-Id: I732a0ddba6e2aa
Closes-Bug: 1849195
Closes-Bug: 1849203
Signed-off-by: Jim Somerville <email address hidden>
commit badc87aec310748
Author: Jim Somerville <email address hidden>
Date: Fri Nov 22 11:55:56 2019 -0500
Uprev wget to version 1.14-18.el7_6.1
This solves:
wget: do_conversion() heap-based buffer overflow
vulnerability (CVE-2019-5953)
See the announcement link:
https:/
for more details.
Change-Id: I0e1c47f95b0cb6
Closes-Bug: 1849210
Signed-off-by: Jim Somerville <email address hidden>
commit 855ef14c832c88e
Author: Jim Somerville <email address hidden>
Date: Thu Nov 21 18:44:38 2019 -0500
Uprev elfutils to version 0.176-2.el7
This solves:
elfutils: Double-free due to double decompression of sections in
crafted ELF causes crash (CVE-2018-16402)
along with quite a few other issues.
See the announcement link:
https:/
for more details.
Change-Id: Ia328b6043c1815
Closes-Bug: 1849201
Signed-off-by: Jim Somerville <email address hidden>
commit 647676c20202217
Author: Jim Somerville <email address hidden>
Date: Thu Nov 21 18:23:21 2019 -0500
Uprev polkit to version 0.112-22.el7
This solves:
polkit: Improper handling of user with uid > INT_MAX leading
to authentication bypass (CVE-2018-19788)
See the announcement link:
https:/
for more details.
Change-Id: I6eb69cd129b2b6
Closes-Bug: 1849202
Signed-off-by: Jim Somerville <email address hidden>
commit e4ea643e3cfbf33
Author: blu <email address hidden>
Date: Thu Nov 7 14:32:01 2019 +0800
Update libX11 related rpms, due to CVE bugs
CVE bugs: CVE-2018-14599, CVE-2018-14600
Extra CVE bugs: CVE-2018-14598, CVE-2018-15853, CVE-2018-15854,
CVE-2018-15855, CVE-2018-15856, CVE-2018-15857, CVE-2018-15859,
CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864
These extra CVE bugs are fixed together. Although libxkbcommon
has a low score, we are including it here anyway just to stay
consistent with RedHat's bundling decision.
The updated rpms are selected from the link provided by RedHat.
(https:/
Tests:
simplex, duplex, multi-node
Closes-Bug: 1849198
Closes-Bug: 1849199
Change-Id: I184ff40d855c60
Signed-off-by: Robin Lu <email address hidden>
commit 391b7d5e3485d9b
Author: Jim Somerville <email address hidden>
Date: Thu Nov 21 14:29:44 2019 -0500
Uprev systemd to version 219-67.el7
This solves:
systemd: line splitting via fgets() allows for state injection
during daemon-reexec (CVE-2018-15686)
along with some other less critical issues. See the security
announcement link:
https:/
for more details.
Change-Id: Ia0fcc7184efea5
Partial-Bug: 1849200
Signed-off-by: Jim Somerville <email address hidden>
commit e47f347e9fd9be6
Author: Angie Wang <email address hidden>
Date: Tue Nov 19 13:46:43 2019 -0500
Upgrade botocore package
Upgrade botocore package from 1.6.0 to 1.12.75.
The new version fixed the ipv6 proxy management issue.
Change-Id: Ib82df18ed9ea72
Partial-Bug: 1853024
Signed-off-by: Angie Wang <email address hidden>
commit b1660fe4a352e1c
Author: Jim Somerville <email address hidden>
Date: Fri Nov 15 16:21:52 2019 -0500
i40e Driver Upgrade in support of N3000 on-board NICs
Uprev i40e to version 2.10.19.30
i40evf gets replaced by iavf version 3.7.61.20
The iavf driver supports both fortville and columbiaville,
so they decided to rename from i40evf to something more generic.
The Intel FPGA Programmable Acceleration Card N3000 contains
dual Intel XL710 NICs and an FPGA for acceleration purposes.
This driver upgrade is required to support those NICs.
Story: 2006740
Task: 37542
Change-Id: I53c731c1b519b1
Signed-off-by: Jim Somerville <email address hidden>
commit bc125699793b97e
Author: zhipengl <email address hidden>
Date: Tue Oct 8 18:40:33 2019 +0800
Update download list for openstack-helm upgrade
Uprade openstack-helm to
Commit-
Upgrade openstack-
Commit-
Story: 2006544
Task: 36623
Change-Id: I991512ef3b0bd9
Signed-off-by: zhipengl <email address hidden>