drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in puppet
Name: |
Mehrere Probleme in puppet |
|
ID: |
SUSE-SU-2013:0618-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
SUSE Linux Enterprise Desktop 11 SP2, SUSE Linux Enterprise Server 11 SP2, SUSE Linux Enterprise Server 11 SP2 for VMware |
|
Datum: |
Do, 4. April 2013, 07:21 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1640
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1652
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1653
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1654
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1655
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2274
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2275 |
|
Applikationen: |
Puppet |
|
Originalnachricht |
SUSE Security Update: Security update for puppet ______________________________________________________________________________
Announcement ID: SUSE-SU-2013:0618-1 Rating: important References: #809839 Cross-References: CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2274 CVE-2013-2275 Affected Products: SUSE Linux Enterprise Server 11 SP2 for VMware SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Desktop 11 SP2 ______________________________________________________________________________
An update that fixes 7 vulnerabilities is now available. It includes one version update.
Description:
puppet has been updated to fix 2.6.18 multiple vulnerabilities and bugs.
* (#19391) Find the catalog for the specified node name * Don't assume master supports SSLv2 * Don't require openssl client to return 0 on failure * Display SSL messages so we can match our regex * Don't assume puppetbindir is defined * Remove unnecessary rubygems require * Run openssl from windows when trying to downgrade master * Separate tests for same CVEs into separate files * Fix order-dependent test failure in rest_authconfig_spec * Always read request body when using Rack * (#19392) (CVE-2013-1653) Fix acceptance test to catch unvalidated model on 2.6 * (#19392) (CVE-2013-1653) Validate indirection model in save handler * Acceptance tests for CVEs 2013 (1640, 1652, 1653, 1654, 2274, 2275) * (#19531) (CVE-2013-2275) Only allow report save from the node matching the certname * (#19391) Backport Request#remote? method * (#8858) Explicitly set SSL peer verification mode. * (#8858) Refactor tests to use real HTTP objects * (#19392) (CVE-2013-1653) Validate instances passed to indirector * (#19391) (CVE-2013-1652) Disallow use_node compiler parameter for remote requests * (#19151) Reject SSLv2 SSL handshakes and ciphers * (#14093) Restore access to the filename in the template * (#14093) Remove unsafe attributes from TemplateWrapper
Security Issue references:
* CVE-2013-2275 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2275 > * CVE-2013-2274 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2274 > * CVE-2013-1655 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1655 > * CVE-2013-1654 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1654 > * CVE-2013-1653 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1653 > * CVE-2013-1652 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1652 > * CVE-2013-1640 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1640 >
Patch Instructions:
To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11 SP2 for VMware:
zypper in -t patch slessp2-puppet-7526
- SUSE Linux Enterprise Server 11 SP2:
zypper in -t patch slessp2-puppet-7526
- SUSE Linux Enterprise Desktop 11 SP2:
zypper in -t patch sledsp2-puppet-7526
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 11 SP2 for VMware (i586 x86_64) [New Version: 2.6.18]:
puppet-2.6.18-0.4.2 puppet-server-2.6.18-0.4.2
- SUSE Linux Enterprise Server 11 SP2 (i586 ia64 ppc64 s390x x86_64) [New Version: 2.6.18]:
puppet-2.6.18-0.4.2 puppet-server-2.6.18-0.4.2
- SUSE Linux Enterprise Desktop 11 SP2 (i586 x86_64) [New Version: 2.6.18]:
puppet-2.6.18-0.4.2
References:
http://support.novell.com/security/cve/CVE-2013-1640.html http://support.novell.com/security/cve/CVE-2013-1652.html http://support.novell.com/security/cve/CVE-2013-1653.html http://support.novell.com/security/cve/CVE-2013-1654.html http://support.novell.com/security/cve/CVE-2013-1655.html http://support.novell.com/security/cve/CVE-2013-2274.html http://support.novell.com/security/cve/CVE-2013-2275.html https://bugzilla.novell.com/809839 ?keywords=bc7ffedd9ace9c95117aaf0acbf73ccc
-- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
|
|
|
|