Your message dated Tue, 10 Nov 2020 22:34:18 +0000 with message-id <e1kccds-0002tw...@fasolo.debian.org> and subject line Bug#973254: fixed in pacemaker 2.0.5~rc2-1 has caused the Debian Bug report #973254, regarding pacemaker: CVE-2020-25654 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 973254: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=973254 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
--- Begin Message ---Source: pacemaker Version: 2.0.4-2 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org> Control: found -1 2.0.1-5 Hi, The following vulnerability was published for pacemaker. CVE-2020-25654[0]: | ACL restrictions bypass If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2020-25654 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25654 [1] https://www.openwall.com/lists/oss-security/2020/10/27/1 [2] https://bugzilla.redhat.com/show_bug.cgi?id=1888191 Regards, Salvatore
--- End Message ---
--- Begin Message ---Source: pacemaker Source-Version: 2.0.5~rc2-1 Done: =?utf-8?q?Ferenc_W=C3=A1gner?= <wf...@debian.org> We believe that the bug you reported is fixed in the latest version of pacemaker, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 973...@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Ferenc Wágner <wf...@debian.org> (supplier of updated pacemaker package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmas...@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 10 Nov 2020 23:02:55 +0100 Source: pacemaker Architecture: source Version: 2.0.5~rc2-1 Distribution: unstable Urgency: medium Maintainer: Debian HA Maintainers <debian-ha-maintain...@alioth-lists.debian.net> Changed-By: Ferenc Wágner <wf...@debian.org> Closes: 963791 973254 Changes: pacemaker (2.0.5~rc2-1) unstable; urgency=medium . [ Rafael David Tinoco ] * [0f1033e] Skip autopkgtest for unprivileged containers: (LP: #1828228) + d/t/control: mark pacemaker test as skippable + d/t/pacemaker: skip if memlock can't be set to unlimited by root . [ Ferenc Wágner ] * [34f6376] pacemaker-dev should pull in libpacemaker1, too * [039f205] The pacemaker-dev transition completed in buster * [800ae5e] Clean up remnants of long finished reorganizations * [0f0340c] pacemaker-dev in buster replaced its old dependencies from wheezy * [6956006] New upstream pre-release (2.0.5~rc2) (Closes: #973254) * [6b30c82] Delete upstreamed patch, refresh the rest * [8e78417] Tie skipping the autopkgtest to the concrete Corosync error. While unlimited memory lock is a good test for privileges, it isn't critical for Corosync. Trigger on a specific error message instead, hint at a possible workaround and document the actual requirements. * [f184e2c] Update symbols files. See 4bcf7eb for the reasoning behind the two renamed symbols which weren't obviously internal: crm_config_error and crm_config_warning. * [0031784] Pacemaker and pacemaker-remote provide Conflicting functions. Breaks without a version was always suspicious to Lintian, and I've got no strong opinion on this specific case, so be it. * [2a33943] Replace the now-transitional build dep with libncurses-dev * [8662ee0] Add missing pkg-config dependencies (Closes: #963791) * [912a22b] New autopkgtest for pkg-config completeness * [5033800] Upgrade watch file to version 4 (no changes needed) Checksums-Sha1: 116b46661cd132a9552046b962c4d939ab50b6e9 3473 pacemaker_2.0.5~rc2-1.dsc ef81572b0b79e75d304e8a8d8f6a94eb4949b314 5432966 pacemaker_2.0.5~rc2.orig.tar.gz d6fafcab4ac49bed664563e8d37d73f2f704b904 46464 pacemaker_2.0.5~rc2-1.debian.tar.xz c64d7f0bee943859cb1fb4516354fe4404780043 27977 pacemaker_2.0.5~rc2-1_amd64.buildinfo Checksums-Sha256: 387969fd0fcc143c70a29e4cb49bcd3d9929a637ebfa66dfa981e0eb328e6d5f 3473 pacemaker_2.0.5~rc2-1.dsc e977f9e2bc261bc442e65847276c21c291477a22b26ce9a2a71041f15cf92511 5432966 pacemaker_2.0.5~rc2.orig.tar.gz 7feb3bba9a13fdc3ceaf8dbaec25362b9145deacaaa04d7420bd9ed1b811e091 46464 pacemaker_2.0.5~rc2-1.debian.tar.xz 7464389c8b1cf1d0569e37656e27e2b67ea2b0b67fba6f8548fe326185041cbb 27977 pacemaker_2.0.5~rc2-1_amd64.buildinfo Files: f09db7c3aa73352b57058d32cc7582e6 3473 admin optional pacemaker_2.0.5~rc2-1.dsc af09f3ace1b63ff3f319313274cd4a35 5432966 admin optional pacemaker_2.0.5~rc2.orig.tar.gz 40c7e71a7f17e7e56f2f45b643d20ce2 46464 admin optional pacemaker_2.0.5~rc2-1.debian.tar.xz a73d70cdf158cacdc44ae78800595929 27977 admin optional pacemaker_2.0.5~rc2-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEwddEx0RNIUL7eugtOsj3Fkd+2yMFAl+rEogACgkQOsj3Fkd+ 2yPRFQ/+KcLuBDGiuqJroyYz5wmZAdBdqBJ5K/nZ59DBUC+b8apm6BkWJs3gWs3T IpSrWRMlzHbS/s/9imJK0lhpSljMyMKf/ZgwqdXlx1yeiCQQzztyTzHFXh7IaZku c7D2ukVzPSSbEfvUhrsVKQCcmEpVhJJtLiU/9LZHAbJIsCfYzW/zszWoOHel9moW fPPqzNynBP8mNgQySGZufxpEap9nS3rRlumS6sXiqT+TvwEXpjR/1t4GwkOPiNTa Jp8qByvgUlK1XmntwFfo7sIgZK+lpzQcP4HK94HxxHLLuXcewTpMFKaQpnBOP6vO dt8d2R2bedyp/rOzrVlwrkIKjpGlTD6a9OLtvgh3UuBHeTlpU9whgTThHZgNtXTp pl6bvL/Cg7NqFK28fgxgMfuucjB4gyeui7J1gEQKvwn6B0VWmknkHqoOCeq4vvUw O/U3P4jn9Zx2KYZk9SPySqhqSy/dY6KLet4S46vtSqXvHIdkGpr+yDqZhS8K1ygs q8Pa5R6GgRUMDDOjUxz8Pa6IaWdqH9py1M/k/BGYLZ9YF7DS+iUpyKloycoraz1V 3OPq/cCJfbLC3aEQ6AZzDRTBML1HAFe5+QKp5G2mA4toPniaAcFBlxL18lQY7uvA 3q9Mfuw+fnnkDTBlcGAkKxcZ1sbuG0BugVAPRpOdqlGAGok6BQc= =sbgg -----END PGP SIGNATURE-----
--- End Message ---
