RE: [CentOS] RH's servers breached

2008-08-26 Thread Ian Forde
On Tue, 2008-08-26 at 13:54 +1200, Tony Wicks wrote: So there are new packages anyway in spite of the other bits. Hi all, have I missed something or is there a CentOS update for 5x but none for 4x ? I've made sure my mirror is synced and looked around at a few others but can't seem

RE: [CentOS] RH's servers breached

2008-08-25 Thread Tony Wicks
So there are new packages anyway in spite of the other bits. Hi all, have I missed something or is there a CentOS update for 5x but none for 4x ? I've made sure my mirror is synced and looked around at a few others but can't seem to see an update ? I just fired up my 4.6 and did yum

RE: [CentOS] RH's servers breached

2008-08-24 Thread Tony Wicks
I see an announcement for the packages on the announce list, but no more information anywhere from the CentOS team (Planet or ML). Are these packages just to be safe or was there something actually found? There's a CVE associated with a different (unrelated) bug in how ssh handled forwarded

RE: [CentOS] RH's servers breached

2008-08-24 Thread William L. Maltby
On Mon, 2008-08-25 at 08:32 +1200, Tony Wicks wrote: snip So there are new packages anyway in spite of the other bits. Hi all, have I missed something or is there a CentOS update for 5x but none for 4x ? I've made sure my mirror is synced and looked around at a few others but can't seem

[CentOS] RH's servers breached

2008-08-22 Thread kfx
What's the point on this for us, CentOS users ? http://www.redhat.com/security/data/openssh-blacklist.html Regards, kfx ___ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

Re: [CentOS] RH's servers breached

2008-08-22 Thread Rui Miguel Silva Seabra
On Fri, Aug 22, 2008 at 05:43:08PM +0200, kfx wrote: What's the point on this for us, CentOS users ? http://www.redhat.com/security/data/openssh-blacklist.html That will only test for compiled RPMS of certain OpenSSH packages. Those RPMS have been signed by the PGP key, so either the key

Re: [CentOS] RH's servers breached

2008-08-22 Thread Scott Beardsley
What's the point on this for us, CentOS users ? I'd like to know if CentOS has been affected by RH's compromise. Can someone please comment? AFAIK, CentOS builds from RHEL SRPMs right? So as Rui mentioned the script that RH provided is useless. They do give the version info of the

Re: [CentOS] RH's servers breached

2008-08-22 Thread Jim Perrin
On Fri, Aug 22, 2008 at 1:59 PM, Scott Beardsley [EMAIL PROTECTED] wrote: What's the point on this for us, CentOS users ? I'd like to know if CentOS has been affected by RH's compromise. Can someone please comment? AFAIK, CentOS builds from RHEL SRPMs right? So as Rui mentioned the script

Re: [CentOS] RH's servers breached

2008-08-22 Thread Paul Norton
On Aug 22, 2008, at 12:25 PM, Jim Perrin wrote: Russ has posted some information about this to planet.centos.org, but basically at this point it does not appear to affect the CentOS population. Karanbir has been crawling through the build system to verify this, and we may release an

Re: [CentOS] RH's servers breached

2008-08-22 Thread Lance Davis
On Fri, 22 Aug 2008, Paul Norton wrote: On Aug 22, 2008, at 12:25 PM, Jim Perrin wrote: Russ has posted some information about this to planet.centos.org, but basically at this point it does not appear to affect the CentOS population. Karanbir has been crawling through the build system to

Re: [CentOS] RH's servers breached

2008-08-22 Thread Jim Perrin
On Fri, Aug 22, 2008 at 5:15 PM, Paul Norton [EMAIL PROTECTED] wrote: I see an announcement for the packages on the announce list, but no more informamtion anywhere from the CentOS team (Planet or ML). Are these packages just to be safe or was there something actually found? There's a CVE