The following Fedora EPEL 5 Security updates need testing:
Age URL
500
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-5630/bugzilla-3.2.10-5.el5
395
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-6608/Django-1.1.4-2.el5
15
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11276/ssmtp-2.61-21.el5
13
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11300/drupal7-theme-zen-5.4-1.el5
9
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11336/lighttpd-1.4.32-1.el5
3
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11396/cacti-0.8.8b-2.el5
1
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11418/graphite-web-0.9.12-1.el5
0
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2013-11448/perl-Crypt-DSA-0.14-8.el5
The following builds have been pushed to Fedora EPEL 5 updates-testing
perl-Crypt-DSA-0.14-8.el5
rubygem-rest-client-1.6.7-1.el5
Details about builds:
================================================================================
perl-Crypt-DSA-0.14-8.el5 (FEDORA-EPEL-2013-11448)
Perl module for DSA signatures and key generation
--------------------------------------------------------------------------------
Update Information:
As taught by the '09 Debian PGP disaster relating to DSA, the randomness source
is extremely important. On systems without /dev/random, Crypt::DSA falls back
to using Data::Random. Data::Random uses rand(), about which the perldoc says
"rand() is not cryptographically secure. You should not rely on it in
security-sensitive situations." In the case of DSA, this is even worse. Using
improperly secure randomness sources can compromise the signing key upon
signature of a message.
See: http://rdist.root.org/2010/11/19/dsa-requirements-for-random-k-value/
It might seem that this would not affect Linux since /dev/random is always
available and so the fall back to Data::Random would never happen. However, if
an application is confined using a MAC system such as SELinux then access to
/dev/random could be denied by policy and the fall back would be triggered.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #743567 - CVE-2011-3599 perl-Crypt-DSA: Cryptographically insecure
method used for random numbers generation on systems without /dev/random
https://bugzilla.redhat.com/show_bug.cgi?id=743567
--------------------------------------------------------------------------------
================================================================================
rubygem-rest-client-1.6.7-1.el5 (FEDORA-EPEL-2013-11450)
Simple REST client for Ruby
--------------------------------------------------------------------------------
Update Information:
Version 1.6.7
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 4 2013 Michal Fojtik <mfoj...@redhat.com> - 1.6.7-1
- Update to 1.6.7
* Mon Mar 21 2011 Michal Fojtik <mfoj...@redhat.com> - 1.4.0-7
- Reverted to old version
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #672213 - request to upgrade package version
https://bugzilla.redhat.com/show_bug.cgi?id=672213
--------------------------------------------------------------------------------
_______________________________________________
epel-devel mailing list
epel-devel@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/epel-devel
