from:"Andy Brody"

[Bug 1464064] Re: Ubuntu apt repos are not available via HTTPS

2019-01-30 Thread Andy Brody

Ubuntu's reliance solely on PGP signatures for package and .iso download
security puts the community at risk.

There have been several APT vulnerabilities in the past few years that
create remote code execution vulnerabilities for Ubuntu systems. It's
irresponsible not to give system operators any option to protect against
these vulnerabilities.

Every LTS release since 10.04 has been affected by at least one RCE
vulnerability in APT that would have been mitigated by HTTPS mirrors.

https://usn.ubuntu.com/3863-1/ CVE-2019-3462
https://usn.ubuntu.com/3156-1/ CVE-2016-1252
https://usn.ubuntu.com/2353-1/ CVE-2014-6273
https://usn.ubuntu.com/2348-1/ CVE-2014-0487, CVE-2014-0488, CVE-2014-0489,
CVE-2014-0490
https://usn.ubuntu.com/2246-1/ CVE-2014-0478
https://usn.ubuntu.com/1762-1/ CVE-2013-1051

Vulnerabilities like these are severe because they make it difficult if
not impossible to securely bootstrap an Ubuntu system from an official
release CD image.

It's especially egregious that security.ubuntu.com is not available over
TLS, since many systems continue to refer to http://security.ubuntu.com
even when they use a separate primary mirror that supports HTTPS.

Besides preventing remote code execution, HTTPS would also improve
confidentiality.

Because Launchpad PPAs are only available over insecure HTTP, anyone
using a PPA that belongs to them will disclose their identity over the
network whenever apt update is run, which can be as often as multiple
times daily.

It's particularly inexcusable that ppa.launchpad.net doesn't deliver
packages over HTTPS because even though it does have a valid HTTPS
certificate, it responds with a 404 Not Found instead of returning PPA
content. [1]

There are many areas of the Internet community where the consensus has
changed from HTTP as the default to secure HTTPS as the default. U.S.
Government policy now requires HTTPS for all U.S. federal websites and
web services, drawing no distinction between browser and non-browser use
cases. [2] The W3C now recommends that the web platform should actively
prefer HTTPS. [3] The IAB recommends that all new protocols use
encryption for confidentiality. [4] Google Chrome has moved over the
past few years to treat HTTPS as the default, explicitly marking
plaintext HTTP connections as non-secure via a warning icon rather than
a neutral presentation. [5] The IETF declared in RFC 7258 that pervasive
monitoring is an attack that the Internet community should address
through encryption and other means. [6]

It's long past time for Ubuntu to follow suit.

[1] e.g.
https://ppa.launchpad.net/kubuntu-ci/stable/ubuntu/dists/bionic/Release returns
404, but works over insecure HTTP
[2] https://https.cio.gov/
[3] https://www.w3.org/2001/tag/doc/web-https
[4] https://www.iab.org/2014/11/14/iab-statement-on-internet-confidentiality/
[5]
https://www.blog.google/products/chrome/milestone-chrome-security-marking-http-not-secure/
[6] https://tools.ietf.org/html/rfc7258

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1051

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-0478

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-0487

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-0488

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-0489

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-0490

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-6273

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1252

--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1464064

Title:
Ubuntu apt repos are not available via HTTPS

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+bug/1464064/+subscriptions

--
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1186793] Re: Updating is over insecure connection

2019-01-30 Thread Andy Brody

** Changed in: ubuntu
   Status: Expired => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1186793

Title:
  Updating is over insecure connection

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+bug/1186793/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1041881] Re: Reinstalling a large server (without formatting) appears to hang during 'Cleaning up' due to updatedb.mlocate

2017-11-24 Thread Andy Brody

Same issue in 16.04. This really doesn't seem like it belongs in a
blocking task with the description "Cleaning up..."

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1041881

Title:
  Reinstalling a large server (without formatting) appears to hang
  during 'Cleaning up' due to updatedb.mlocate

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/pkgsel/+bug/1041881/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1531847] Re: nethogs needs to be updated to 0.8.1 on kernel 4.3.3-2+

2017-06-28 Thread Andy Brody

Hi folks,

This seems like a good candidate for an SRU for Trusty: nethogs is
completely broken by this bug because it crashes at startup.

Attached is a debdiff with a no-change backport from Xenial (nethogs
0.8.1-0.3) to Trusty (currently nethogs 0.8.0-1).

I've tested that the backport solves this bug. I tested both kernels
available on Trusty: the original linux-image-generic (3.13.0-121) and
the linux-image-generic-lts-xenial (4.4.0-83) are both affected by the
bug and fixed by the update to nethogs 0.8.1.

You can also find the backported package in my PPA:
https://launchpad.net/~abrody/+archive/ubuntu/ppa/+packages?field.name_filter=nethogs_filter=published_filter=trusty

I don't really know what I'm doing with the debdiff, so please let me
know if I can make corrections. It seems like the UDD import for nethogs
has been failing for quite some time: http://package-
import.ubuntu.com/status/nethogs.html#2016-02-22 20:07:41.198487


I did test that the debdiff applies cleanly:

$ pull-lp-source nethogs trusty
$ pull-lp-source -d nethogs xenial
$ cd nethogs-0.8.0
$ quilt pop -a
$ patch -p1 < ../trusty-backport.debdiff
$ debuild -S


[Regression potential]

Since the package is already entirely nonfunctional in trusty (as far as
I can tell) the regression potential seems low. The updated version also
has had a long time to be tested in Xenial, and this same upstream
version is available in Debian Jessie backports.


** Patch added: "trusty-backport.debdiff"
   
https://bugs.launchpad.net/ubuntu/+source/nethogs/+bug/1531847/+attachment/4905180/+files/trusty-backport.debdiff

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1531847

Title:
  nethogs needs to be updated to 0.8.1 on kernel 4.3.3-2+

To manage notifications about this bug go to:
https://bugs.launchpad.net/raspbian/+bug/1531847/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1503979] Re: ubuntu-support-status throws exeption No date tag found (regression)

2015-12-14 Thread Andy Brody

This also affects vivid, yes? It seems like many people will be running
this on vivid as it approaches end of life.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1503979

Title:
  ubuntu-support-status throws exeption No date tag found (regression)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-apt/+bug/1503979/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1435113] Re: [SRU] Virtualbox host broken on Broadwell CPUs

2015-04-23 Thread Andy Brody

Hi folks,

Apologies for the long delay here. The packages built with that patch do
appear to fix the problem. Many thanks!

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1435113

Title:
  [SRU] Virtualbox host broken on Broadwell CPUs

To manage notifications about this bug go to:
https://bugs.launchpad.net/virtualbox/+bug/1435113/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1435113] [NEW] Virtualbox host broken on Broadwell CPUs

2015-03-22 Thread Andy Brody

Public bug reported:

Due to VirtualBox #13820 [1], Linux hosts running on Broadwell CPUs are
unable to start VirtualBox VMs.

Launching a VM hangs at 0%, and logs dmesg output like this:

[ 6204.331045] BUG: unable to handle kernel paging request at
7f6f95a043e0

This issue was reportedly fixed in version 4.3.22.

Given that this bug makes VirtualBox entirely unusable on affected
machines, this seems like a plausible candidate for an SRU release.

[1] https://www.virtualbox.org/ticket/13820

** Affects: virtualbox (Ubuntu)
 Importance: Undecided
 Status: New

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1435113

Title:
  Virtualbox host broken on Broadwell CPUs

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/virtualbox/+bug/1435113/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1387303] Re: regression: gnome-keyring components can't be disabled anymore

2015-03-06 Thread Andy Brody

This seems to fix the problem on utopic with 3.10.1-1ubuntu7.1

** Tags removed: verification-needed-utopic
** Tags added: verification-done-utopic

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1387303

Title:
  regression: gnome-keyring components can't be disabled anymore

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1387303/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

53 matches

Mail list logo