[Bug 1547133] Re: After automatically upgrading Xubuntu library libnss3 to version 2:3.21-0ubuntu0.15.10.1 some apps stop working

2016-03-24 Thread Marc Deslauriers
This is a bug in QtWebEngine. The file src/3rdparty/chromium/net/third_party/nss/patches/chacha20poly1305.patch contains the following: +/* This is a bodge to allow this code to be compiled against older NSS + * headers. */ +#ifndef CKM_NSS_CHACHA20_POLY1305 +#define CKM_NSS_CHACHA20_POLY1305

[Bug 1556300] Re: Please merge ebtables 2.0.10.4-3.4 from Debian unstable

2016-03-15 Thread Marc Deslauriers
Debdiff in comment #2 looks good. Uploaded. Thanks! ** Changed in: ebtables (Ubuntu) Status: New => Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to ebtables in Ubuntu. https://bugs.launchpad.net/bugs/1556300

[Bug 1555357] Re: Please merge checksecurity 2.0.16+nmu1 from Debian unstable

2016-03-15 Thread Marc Deslauriers
ACK on the debdiff. I've made a slight change to remove mention of fcron twice. Uploading now. Thanks! ** Changed in: checksecurity (Ubuntu) Status: New => Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to

[Bug 1556265] Re: Please merge nagios3 3.5.1.dfsg-2.1 from Debian unstable

2016-03-15 Thread Marc Deslauriers
Debdiff looks good. Uploading now. Thanks! ** Changed in: nagios3 (Ubuntu) Status: New => Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nagios3 in Ubuntu. https://bugs.launchpad.net/bugs/1556265 Title:

[Bug 1556304] Re: Please merge memcached 1.4.25-2 from Debian unstable

2016-03-15 Thread Marc Deslauriers
Debdiff looks good, ACK. Uploading now. Thanks! ** Changed in: memcached (Ubuntu) Status: New => Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to memcached in Ubuntu. https://bugs.launchpad.net/bugs/1556304

[Bug 1553251] Re: USN-2915-1 introduced a regression in is_safe_url()

2016-03-07 Thread Marc Deslauriers
First round of regression fixes used incomplete patch. Proper upstream commits are: https://github.com/django/django/commit/ada7a4aefb9bec4c34667b511022be6057102f98 https://github.com/django/django/commit/552f03869ea7f3072b3fa19ffb6cb2d957fd8447 -- You received this bug notification because you

[Bug 1553251] Re: USN-2915-1 introduced a regression in is_safe_url()

2016-03-07 Thread Marc Deslauriers
Ubuntu 12.04 LTS isn't affected by the regression. ** Changed in: python-django (Ubuntu Precise) Status: Confirmed => Invalid -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to python-django in Ubuntu.

[Bug 1553251] [NEW] USN-2915-1 introduced a regression in is_safe_url()

2016-03-04 Thread Marc Deslauriers
Assignee: Marc Deslauriers (mdeslaur) Status: Confirmed ** Affects: python-django (Ubuntu Precise) Importance: Undecided Assignee: Marc Deslauriers (mdeslaur) Status: Confirmed ** Affects: python-django (Ubuntu Trusty) Importance: Undecided Assignee: Marc

[Bug 1553251] Re: USN-2915-1 introduced a regression in is_safe_url()

2016-03-04 Thread Marc Deslauriers
https://github.com/django/django/pull/6242 -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to python-django in Ubuntu. https://bugs.launchpad.net/bugs/1553251 Title: USN-2915-1 introduced a regression in is_safe_url() To manage

[Bug 1550423] Re: ERR_SSL_PROTOCOL_ERROR

2016-02-27 Thread Marc Deslauriers
Chrome 45 is too old. You need to update to Chrome 47 or later, preferably to the current version, Chrome 48. I am closing this bug as running an old version of Chrome is not supported. ** Changed in: nss (Ubuntu) Status: Incomplete => Won't Fix -- You received this bug notification

[Bug 1550423] Re: ERR_SSL_PROTOCOL_ERROR

2016-02-26 Thread Marc Deslauriers
What version of Chrome are you running? ** Package changed: ca-certificates (Ubuntu) => nss (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nss in Ubuntu. https://bugs.launchpad.net/bugs/1550423 Title:

[Bug 1547147] Re: libnss3-dev adds epoch 2 to the Version in pkg-config's pc file

2016-02-18 Thread Marc Deslauriers
Confirmed, the epoch wasn't supposed to get bumped in precise. ** Also affects: nss (Ubuntu Precise) Importance: Undecided Status: New ** Changed in: nss (Ubuntu Precise) Status: New => Confirmed ** Changed in: nss (Ubuntu Precise) Assignee: (unassigned) =>

[Bug 1545750] Re: Access denied if the share path is "/"

2016-02-15 Thread Marc Deslauriers
ACK on the debdiffs, I've uploaded them for building with the following small changes: - Clean out cruft in trusty and wily patched - wrapped changelog line to fix lintian warning - fixed trusty package version number - re-targeted to -security pocket. I will publish these updates as a security

[Bug 1545750] Re: Access denied if the share path is "/"

2016-02-15 Thread Marc Deslauriers
) Importance: Undecided => Medium ** Changed in: samba (Ubuntu Trusty) Importance: Undecided => Medium ** Changed in: samba (Ubuntu Wily) Importance: Undecided => Medium ** Changed in: samba (Ubuntu) Assignee: (unassigned) => Marc Deslauriers (mdeslaur) ** Changed in: samba (Ub

[Bug 523113] Re: missing manpages for nss tools

2016-02-04 Thread Marc Deslauriers
Ubuntu 15.10 and up now include manpages for nss tools. Marking this bug as closed. ** Changed in: nss (Ubuntu) Status: Triaged => Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nss in Ubuntu.

[Bug 1537750] [NEW] mysql 5.5.47, 5.6.28 security update tracking bug

2016-01-25 Thread Marc Deslauriers
Status: Fix Released ** Affects: mysql-5.5 (Ubuntu Precise) Importance: Medium Assignee: Marc Deslauriers (mdeslaur) Status: Confirmed ** Affects: mysql-5.6 (Ubuntu Precise) Importance: Undecided Status: Invalid ** Affects: mysql-5.5 (Ubuntu Trusty

[Bug 1534203] Re: openssl_random_pseudo_bytes() security bug and PHP packages

2016-01-20 Thread Marc Deslauriers
ortance: Undecided => Medium ** Changed in: php5 (Ubuntu Precise) Assignee: (unassigned) => Marc Deslauriers (mdeslaur) ** Changed in: php5 (Ubuntu Vivid) Importance: Undecided => Medium ** Changed in: php5 (Ubuntu Wily) Importance: Undecided => Medium ** Changed in: php5

[Bug 1532648] Re: Please merge openldap 2.4.42+dfsg-2 (main) from Debian testing (main)

2016-01-19 Thread Marc Deslauriers
Merge looks good. Uploading. Thanks! -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openldap in Ubuntu. https://bugs.launchpad.net/bugs/1532648 Title: Please merge openldap 2.4.42+dfsg-2 (main) from Debian testing (main) To manage

[Bug 1530837] Re: Logsys file leaks in /dev/shm after sigabrt, sigsegv and when running corosync -v

2016-01-19 Thread Marc Deslauriers
Hi! Thanks for providing the debdiff. The patches in the debdiff contain unwanted changes: $ quilt push -a Applying patch leak-produced-by-corosync-v.patch patching file exec/main.c patching file exec/main.c.orig Applying patch Handle-SIGSEGV-and-SIGABRT-signals.patch patching file exec/main.c

[Bug 1524590] Re: package libaio1:i386 0.3.110-1 failed to install/upgrade: package libaio1:i386 is already installed and configured

2016-01-14 Thread Marc Deslauriers
*** This bug is a duplicate of bug 1407757 *** https://bugs.launchpad.net/bugs/1407757 Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as

[Bug 1475050] Re: unprivileged guest to host real-root escape via lxc-attach

2015-12-18 Thread Marc Deslauriers
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/1475050 Title: unprivileged guest to host real-root escape via

[Bug 1520146] Re: package python-samba 2:4.1.6+dfsg-1ubuntu2.14.04.7 failed to install/upgrade: subprocess new pre-removal script returned error exit status 1

2015-12-09 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1522190] Re: Permission denied (publickey) whereas the public key has been inserted into ~/.ssh/authorized_keys: "usePAM no" issue

2015-12-09 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1515986] Re: unable to properly install backuppc on wily 15.10

2015-12-08 Thread Marc Deslauriers
Merge debdiff looks good, the only thing that was problematic was par2 didn't get dropped from the Build-Depends, so I fixed that. Uploaded to xenial. ** Changed in: backuppc (Ubuntu) Status: Incomplete => Fix Committed -- You received this bug notification because you are a member of

[Bug 1520568] Re: All queries fails when 'google' is used: ERR_SSL_PROTOCOL_ERROR

2015-12-02 Thread Marc Deslauriers
I can't reproduce this issue in midori at all. I can reproduce it with https://te-st.ru -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nss in Ubuntu. https://bugs.launchpad.net/bugs/1520568 Title: All queries fails when 'google'

[Bug 1520568] Re: All queries fails when 'google' is used: ERR_SSL_PROTOCOL_ERROR

2015-12-01 Thread Marc Deslauriers
nss 3.20.1 works, nss 3.21 doesn't. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nss in Ubuntu. https://bugs.launchpad.net/bugs/1520568 Title: All queries fails when 'google' is used: ERR_SSL_PROTOCOL_ERROR To manage

[Bug 1520568] Re: All queries fails when 'google' is used: ERR_SSL_PROTOCOL_ERROR

2015-12-01 Thread Marc Deslauriers
OK, a few more notes on reproducing this: 1- I can't reproduce this by installing the daily live cd in a VM 2- I can reproduce it successfully by installing the daily live cd on real hardware This means it's probably not related to which Google servers are being hit, and is likely

[Bug 1520568] Re: All queries fails when 'google' is used: ERR_SSL_PROTOCOL_ERROR

2015-11-30 Thread Marc Deslauriers
I can't seem to reproduce this. https://www.google.com works fine in an up-to-date image with Chromium and nss 2:3.21-1ubuntu2. Could you please give the exact steps require to see this issue? -- You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 1518728] Re: package php5-fpm 5.6.11+dfsg-1ubuntu3.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2015-11-25 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1512131] Re: Apparmor complains about multiple /run/dovecot file access

2015-11-10 Thread Marc Deslauriers
** Package changed: dovecot (Ubuntu) => apparmor (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1512131 Title: Apparmor complains about multiple /run/dovecot file access To

[Bug 1509817] Re: libxml_disable_entity_loader is not theadsafe

2015-11-05 Thread Marc Deslauriers
I'll include this in the next php5 security update. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1509817 Title: libxml_disable_entity_loader is not theadsafe To manage

[Bug 1510520] Re: Possible DoS with fork in socat (CVE-2015-1379)

2015-10-29 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is

[Bug 1509817] Re: Please backport PHP fix #64938 (fixed in 5.5.22) on 14.04

2015-10-29 Thread Marc Deslauriers
** Information type changed from Private Security to Public Security ** Changed in: php5 (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1509817

[Bug 1508698] Re: default account "guest" has administrator privileges

2015-10-29 Thread Marc Deslauriers
** Information type changed from Private Security to Public Security ** Changed in: rabbitmq-server (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to rabbitmq-server in Ubuntu.

[Bug 1508441] Re: mysql 5.5.46, 5.6.27 security update tracking bug

2015-10-28 Thread Marc Deslauriers
** Changed in: mysql-5.6 (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to mysql-5.6 in Ubuntu. https://bugs.launchpad.net/bugs/1508441 Title: mysql 5.5.46, 5.6.27 security update

[Bug 1508441] Re: mysql 5.5.46, 5.6.27 security update tracking bug

2015-10-28 Thread Marc Deslauriers
Looks like you upgraded from a version that wasn't in the archive, namely 5.6.25-3+deb.sury.org~trusty+1. Are you able to reproduce the issue in a clean install without that unofficial package? -- You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 1508441] Re: mysql 5.5.46, 5.6.27 security update tracking bug

2015-10-28 Thread Marc Deslauriers
I can't reproduce that failure, could you please attach your /var/log/dpkg.log file? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to mysql-5.6 in Ubuntu. https://bugs.launchpad.net/bugs/1508441 Title: mysql 5.5.46, 5.6.27 security

[Bug 1508441] [NEW] mysql 5.5.46, 5.6.27 security update tracking bug

2015-10-21 Thread Marc Deslauriers
: Medium Assignee: Marc Deslauriers (mdeslaur) Status: Confirmed ** Affects: mysql-5.5 (Ubuntu Precise) Importance: Medium Assignee: Marc Deslauriers (mdeslaur) Status: Confirmed ** Affects: mysql-5.6 (Ubuntu Precise) Importance: Undecided Status

[Bug 1400517] Re: Please update Tomcat7 in trusty-security to >= 7.0.55 to enable easier server info hiding

2015-10-19 Thread Marc Deslauriers
** Changed in: tomcat7 (Ubuntu) Assignee: Alex Kiss (sysrex) => (unassigned) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to tomcat7 in Ubuntu. https://bugs.launchpad.net/bugs/1400517 Title: Please update Tomcat7 in

[Bug 1499063] Re: awscli crashes immediately on start

2015-09-23 Thread Marc Deslauriers
*** This bug is a duplicate of bug 1499075 *** https://bugs.launchpad.net/bugs/1499075 ** This bug has been marked a duplicate of bug 1499075 python3.4.3 SRU breaks awscli -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to awscli

[Bug 1481388] Re: NTP : Use-after-free in routing socket code after dropping root

2015-09-15 Thread Marc Deslauriers
** Bug watch added: Debian Bug tracker #795315 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=795315 ** Also affects: ntp (Debian) via http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=795315 Importance: Unknown Status: Unknown ** Bug watch added: bugs.ntp.org/ #2224

[Bug 1474294] Re: Please merge antlr3 3.2-11 (universe) from Debian unstable (main)

2015-09-15 Thread Marc Deslauriers
Looks like this all got synced. Marking as fix released. ** Changed in: plexus-compiler (Ubuntu) Status: Confirmed => Fix Released ** Changed in: maven-compiler-plugin (Ubuntu) Status: Confirmed => Fix Released ** Changed in: antlr3 (Ubuntu) Status: Incomplete => Fix

[Bug 1445914] Re: Secure web socket proxy does not work in Apache 2.4.7

2015-09-15 Thread Marc Deslauriers
Thanks for the debdiff. The patch looks good, but could you please add proper DEP-3 patch tags, including the Origin tag? For example: Description: xxx Origin: upstream, https://svn.apache.org/viewvc?view=revision=1594625 Author: xxx See the following for more information:

[Bug 1394403] Re: RewriteRule of "^$" is broken

2015-09-15 Thread Marc Deslauriers
Wesley, have you gotten a chance to test the package in trusty-proposed? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to the bug report. https://bugs.launchpad.net/bugs/1394403 Title: RewriteRule of "^$" is broken To manage

[Bug 1481388] Re: NTP : Use-after-free in routing socket code after dropping root

2015-09-15 Thread Marc Deslauriers
ACK on the debdiffs, thanks! I've slightly modified the whitespace in the changelog and have added the bug number, and have uploaded it to wily, and to the other releases for processing by the SRU team. ** Tags removed: verification-done ** Changed in: ntp (Ubuntu Wily) Status: In

[Bug 1493188] Re: overlayroot doesn't work with vanilla kernel

2015-09-09 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1467716] Re: "gem install" fetches packages from unencrypted HTTP URL

2015-09-09 Thread Marc Deslauriers
The instructions given in the bug description aren't accurate. The make gem use an https URL, you need to create an /etc/gemrc or ~/.gemrc file with the following contents: :sources: - https://rubygems.org Make sure it works by using "gem environment" and making sure "REMOTE SOURCES" is using

[Bug 1476769] Re: When activating OpenVPN without DHCP6, random traffic will be routed without VPN

2015-09-09 Thread Marc Deslauriers
** Changed in: network-manager (Ubuntu) Status: New => Confirmed ** Changed in: openvpn (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to openvpn in Ubuntu.

[Bug 1279826] Re: CVE-2013-7108

2015-09-09 Thread Marc Deslauriers
** Also affects: nagios3 (Ubuntu Wily) Importance: Undecided Status: New ** Also affects: icinga (Ubuntu Wily) Importance: Undecided Status: Fix Released ** Also affects: nagios3 (Ubuntu Precise) Importance: Undecided Status: New ** Also affects: icinga (Ubuntu

[Bug 1357018] Re: image format and state load security updates tracking bug

2015-09-01 Thread Marc Deslauriers
These updates were published a long time ago. Closing. ** Changed in: qemu (Ubuntu Trusty) Status: Confirmed => Fix Released ** Changed in: qemu-kvm (Ubuntu Precise) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of Ubuntu Server

[Bug 1394403] Re: RewriteRule of ^$ is broken

2015-08-18 Thread Marc Deslauriers
NACK on the debdiff. It doesn't use the actual fix that went into Apache 2.4. It uses a proposed patch from the bug that wasn't the way it was ultimately fixed. Please prepare a new debdiff with the following commit: https://github.com/apache/httpd/commit/f0529e54b8d889322b5113eb623e263556bfa28e

[Bug 1485807] Re: Fix for CVE-2015-5600 can sometimes erroneously block logins

2015-08-17 Thread Marc Deslauriers
*** This bug is a duplicate of bug 1485719 *** https://bugs.launchpad.net/bugs/1485719 ** This bug has been marked a duplicate of bug 1485719 Uninitialized struct field in the fix for CVE-2015-5600 causes random auth failures -- You received this bug notification because you are a

[Bug 1485719] Re: Uninitialized struct field in the fix for CVE-2015-5600 causes random auth failures

2015-08-17 Thread Marc Deslauriers
I have uploaded updated packages to fix this issue to the following PPA: https://launchpad.net/~ubuntu-security- proposed/+archive/ubuntu/ppa/+packages Please test and see if they fix the issue in your environment. If they do, and they pass QA, I will publish them as security updates tomorrow.

[Bug 1485719] Re: Uninitialized struct field in the fix for CVE-2015-5600 causes random auth failures

2015-08-17 Thread Marc Deslauriers
) Importance: Undecided Status: New ** Changed in: openssh (Ubuntu Precise) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: openssh (Ubuntu Trusty) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: openssh (Ubuntu Vivid) Assignee

[Bug 1392018] Re: apparmor stops /var/run/ldapi from being read causing ldap to fail

2015-07-21 Thread Marc Deslauriers
ACK on the debdiffs, they look good. Thanks! Uploaded for processing by the SRU team. ** Changed in: openldap (Ubuntu Utopic) Status: New = In Progress ** Changed in: openldap (Ubuntu Vivid) Status: New = In Progress -- You received this bug notification because you are a member

[Bug 1469168] Re: localhost is listed as a debian-server (and everything is included to fix it)

2015-07-21 Thread Marc Deslauriers
Looks good, ACK. Uploaded. Thanks! ** Changed in: nagios3 (Ubuntu) Status: In Progress = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nagios3 in Ubuntu. https://bugs.launchpad.net/bugs/1469168 Title:

[Bug 1427406] Re: data corruption on arm64 and ppc64el

2015-07-16 Thread Marc Deslauriers
I'm sorry, but I don't see how we can carry these patches in the Ubuntu MySQL packages. Since Oracle no longer discloses details of their MySQL security vulnerabilities, we have no other choice than to upgrade to their latest upstream version when they publish vulnerability details. This implies

[Bug 1427406] Re: data corruption on arm64 and ppc64el

2015-07-16 Thread Marc Deslauriers
After discussing my concerns with dannf and rbasak on irc, we have come to the following: - We are aware of this issue, and are making reasonable efforts to ensure that users are not impacted. However, as highlighted by point (5) below, there may be circumstances in which we have to regress this

[Bug 1475294] [NEW] mysql 5.5.44, 5.6.25 security update tracking bug

2015-07-16 Thread Marc Deslauriers
Assignee: Marc Deslauriers (mdeslaur) Status: Confirmed ** Affects: mysql-5.5 (Ubuntu Precise) Importance: Medium Assignee: Marc Deslauriers (mdeslaur) Status: Confirmed ** Affects: mysql-5.6 (Ubuntu Precise) Importance: Undecided Status: Invalid ** Affects

[Bug 1451539] Re: tomcat7 fails to build in trusty (updated openjdk-7?)

2015-06-26 Thread Marc Deslauriers
Should be fixed in (7.0.52-1ubuntu0.3) by: * Replace expired ssl certs and use TLS to fix tests causing FTBFS: - debian/patches/0022-use-tls-in-ssl-unit-tests.patch - debian/patches/0023-replace-expired-ssl-certificates.patch - debian/source/include-binaries ** Changed in: tomcat7

[Bug 1465014] Re: after update still vulnerable against LOGJAM

2015-06-25 Thread Marc Deslauriers
** Also affects: firefox (Ubuntu) Importance: Undecided Status: New ** Changed in: firefox (Ubuntu) Status: New = Confirmed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nss in Ubuntu.

[Bug 1392018] Re: apparmor stops /var/run/ldapi from being read causing ldap to fail

2015-06-23 Thread Marc Deslauriers
The actual fix that went into wily is: # pid files and sockets /{,var/}run/slapd/* w, /{,var/}run/slapd/ldapi rw, /{,var/}run/nslcd/socket rw, Ryan, could you please update your proposed debdiffs to reflect the actual changes that went into the development release? Thanks! -- You received

[Bug 1464881] Re: package apache2-utils (not installed) failed to install/upgrade: 正试图覆盖 /usr/sbin/httxt2dbm,它同时被包含于软件包 apache2.2-bin 2.2.14-5ubuntu8.15

2015-06-19 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1197884] Re: apache2.2 SSL has no forward-secrecy: need ECDHE keys

2015-05-29 Thread Marc Deslauriers
There is a test package for precise available here: https://launchpad.net/~ubuntu-security- proposed/+archive/ubuntu/ppa/+packages Once it has gone through testing, it will be published as an update. -- You received this bug notification because you are a member of Ubuntu Server Team, which is

[Bug 1445906] Re: 5.6.24 security update

2015-05-29 Thread Marc Deslauriers
Thanks for the diff in comment #2, but that's not a valid approach for updating the package in trusty. Someone needs to actually update the package in trusty using the mysql 5.6.24 tarball from the vivid package. ** Changed in: mysql-5.6 (Ubuntu Trusty) Status: Fix Committed = Confirmed

[Bug 1395098] Re: Please merge openldap 2.4.40-4 (main) from Debian unstable (main)

2015-05-26 Thread Marc Deslauriers
ACK on the merge. Thanks! I've uploaded it to wily with a couple of changes: - removed the extra Disable mdb backend... from changelog - removed d/slapd.dirs: add etc/apparmor.d/force-complain from changelog, as it looks like that hasn't actually been done in a long time. Thanks! ** Changed

[Bug 1446809] Re: [SRU] denial of service via an LDAP search query (CVE-2012-1164, CVE-2013-4449, CVE-2015-1545)

2015-05-25 Thread Marc Deslauriers
ACK on the debdiffs, I've uploaded them for building. (I removed the extra patch, and changed the pocket to -security). What testing did you perform on these? ** Also affects: openldap (Ubuntu Trusty) Importance: Undecided Status: New ** Also affects: openldap (Ubuntu Utopic)

[Bug 1456864] Re: package apache2 2.4.10-1ubuntu1.1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2015-05-22 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1197884] Re: apache2.2 SSL has no forward-secrecy: need ECDHE keys

2015-05-22 Thread Marc Deslauriers
I'll work on releasing this for precise next week. ** Changed in: apache2 (Ubuntu Precise) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to the bug report. https

[Bug 1449975] Re: Security bugs are never fixed in the tomcat packages

2015-04-30 Thread Marc Deslauriers
Thanks for reporting this issue. You can track the security updates for tomcat 7 here: http://people.canonical.com/~ubuntu-security/cve/pkg/tomcat7.html CVE-2014-0075, CVE-2014-0096 and CVE-2014-0099 have been published for trusty in this advisory: http://www.ubuntu.com/usn/usn-2302-1/

[Bug 1445914] Re: Secure web socket proxy does not work in Apache 2.4.7

2015-04-24 Thread Marc Deslauriers
** Bug watch added: bz.apache.org/bugzilla/ #55320 https://bz.apache.org/bugzilla/show_bug.cgi?id=55320 ** Also affects: apache2 via https://bz.apache.org/bugzilla/show_bug.cgi?id=55320 Importance: Unknown Status: Unknown ** Information type changed from Private Security to

[Bug 1445906] Re: 5.6.24 security update

2015-04-19 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is

[Bug 1444616] Re: mysql 5.5.43, 5.6.24 security update tracking bug

2015-04-16 Thread Marc Deslauriers
) Status: New = Invalid ** Changed in: mysql-5.6 (Ubuntu Vivid) Importance: Undecided = Medium ** Changed in: mysql-5.6 (Ubuntu Vivid) Status: New = Confirmed ** Changed in: mysql-5.6 (Ubuntu Vivid) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: mysql-5.5

[Bug 1444616] [NEW] mysql 5.5.43, 5.6.24 security update tracking bug

2015-04-15 Thread Marc Deslauriers
*** This bug is a security vulnerability *** Public security bug reported: http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html ** Affects: mysql-5.5 (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of

[Bug 1230917] Re: [SRU] php5-fpm logrotate errors after package switched to upstart

2015-03-31 Thread Marc Deslauriers
Debdiff in comment #35 looks good, uploading for processing by the SRU team. Thanks! -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1230917 Title: [SRU] php5-fpm logrotate errors

[Bug 1230917] Re: [SRU] php5-fpm logrotate errors after package switched to upstart

2015-03-31 Thread Marc Deslauriers
** Changed in: php5 (Ubuntu Trusty) Status: Triaged = In Progress -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1230917 Title: [SRU] php5-fpm logrotate errors after package

[Bug 1410383] Re: wrong process name match in logrotate script

2015-03-31 Thread Marc Deslauriers
Looks good. Uploaded to Trusty for processing by the SRU team Thanks! ** Changed in: puppet (Ubuntu) Status: Triaged = Fix Committed ** Changed in: puppet (Ubuntu Trusty) Status: Triaged = In Progress -- You received this bug notification because you are a member of Ubuntu

[Bug 246702] Re: [CVE-2008-1447] Randomize DNS query source ports to prevent cache poisoning

2015-03-26 Thread Marc Deslauriers
This is fixed in all currently-supported versions of Ubuntu. ** Changed in: glibc (Ubuntu) Status: Confirmed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to bind9 in Ubuntu. https://bugs.launchpad.net/bugs/246702

[Bug 1436899] Re: enable ssl

2015-03-26 Thread Marc Deslauriers
*** This bug is a duplicate of bug 1097032 *** https://bugs.launchpad.net/bugs/1097032 It's not compiled with SSL support because of licensing reasons. ** Package changed: squidguard (Ubuntu) = squid3 (Ubuntu) ** Information type changed from Private Security to Public ** This bug has been

[Bug 1436707] Re: package libapache2-mod-php5 5.5.12+dfsg-2ubuntu4.3 failed to install/upgrade: subprocess installed post-installation script returned error exit status 127

2015-03-26 Thread Marc Deslauriers
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 1434999] Re: Creating a new VM in virt-manager fails because of apparmor permissions

2015-03-24 Thread Marc Deslauriers
** Package changed: virt-manager (Ubuntu) = libvirt (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libvirt in Ubuntu. https://bugs.launchpad.net/bugs/1434999 Title: Creating a new VM in virt-manager fails because of

[Bug 1432644] Re: VM permanently tries to read /dev/shm/lttng-ust-wait-5

2015-03-24 Thread Marc Deslauriers
** Package changed: virt-manager (Ubuntu) = libvirt (Ubuntu) ** Tags added: apparmor -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libvirt in Ubuntu. https://bugs.launchpad.net/bugs/1432644 Title: VM permanently tries to read

[Bug 1400473] Re: Apache 2.2 on Ubuntu 12.04 LTS doesn't allow disabling TLS1.0

2015-03-19 Thread Marc Deslauriers
Support for the TLSv1.1 and TLSv1.2 configuration options was added to Apache 2.2.24. The version of Apache in Ubuntu 12.04 is 2.2.22, hence it needs to have the following commit backported to be able to specifically use TLSv1.1 and TLSV1.2 in the SSLProtocol directive:

[Bug 1400473] Re: Apache 2.2 on Ubuntu 12.04 LTS only supports TLS1.0 which is vulnerable to BEAST attack

2015-03-17 Thread Marc Deslauriers
While apache in Ubuntu 12.04 does support TLSv1.2, it doesn't allow specifying the configuration options to selectively disable TLSv1.0. The following commit needs to be backported: https://svn.apache.org/viewvc?view=revisionrevision=1445104 ** Package changed: openssl (Ubuntu) = apache2

[Bug 1400473] Re: Apache 2.2 on Ubuntu 12.04 LTS doesn't allow disabling TLS1.0

2015-03-17 Thread Marc Deslauriers
This is a connection to the default configuration of apache on Ubuntu 12.04, showing it does support TLSv1.2: $ openssl s_client -tls1_2 -connect test-precise:443 snip New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported

[Bug 1432555] Re: Please fix handling of cookies on redirect

2015-03-17 Thread Marc Deslauriers
** Changed in: requests (Ubuntu Vivid) Status: Confirmed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to requests in Ubuntu. https://bugs.launchpad.net/bugs/1432555 Title: Please fix handling of cookies on

[Bug 1432555] Re: Please fix handling of cookies on redirect

2015-03-16 Thread Marc Deslauriers
) Status: Confirmed = Invalid ** Changed in: requests (Ubuntu Trusty) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: requests (Ubuntu Utopic) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: requests (Ubuntu Vivid) Assignee: (unassigned) = Marc

[Bug 1427884] Re: Merge vsftpd 3.0.2-18 (main) from Debian unstable (main)

2015-03-05 Thread Marc Deslauriers
ACK on the debdiff in comment #6, uploaded to vivid. Thanks! ** Changed in: vsftpd (Ubuntu) Status: Confirmed = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to vsftpd in Ubuntu.

[Bug 1427884] Re: Merge vsftpd 3.0.2-18 (main) from Debian unstable (main)

2015-03-04 Thread Marc Deslauriers
I looked at the debian-ubuntu debdiff, and it FTBFS because you dropped dh-apport from debian/control. How did you get this to compile? Please fix it, and test compile this before submitting it again. ** Changed in: vsftpd (Ubuntu) Status: Confirmed = Incomplete -- You received this

[Bug 1410383] Re: wrong process name match in logrotate script

2015-03-03 Thread Marc Deslauriers
** Package changed: puppetmaster (Ubuntu) = puppet (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to puppet in Ubuntu. https://bugs.launchpad.net/bugs/1410383 Title: wrong process name match in logrotate script To manage

[Bug 1230917] Re: [SRU] php5-fpm logrotate errors after package switched to upstart

2015-03-03 Thread Marc Deslauriers
Nack on the debdiff. The package in utopic adds a script called php5-fpm-reopenlogs which correctly parses /etc/php5/fpm/php-fpm.conf to obtain the pid file location in instead of hardcoding it to /run/php5-fpm.pid. Pushing an SRU that hardcodes that location may break existing setups. Please

[Bug 1230917] Re: [SRU] php5-fpm logrotate errors after package switched to upstart

2015-03-03 Thread Marc Deslauriers
Unsubscribing ubuntu-sponsors for now, please re-subscribe the group once a fixed debdiff has been attached to this bug. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/1230917 Title:

[Bug 1342709] Re: mysql 5.5.38 security update tracking bug

2015-02-27 Thread Marc Deslauriers
** Changed in: percona-xtradb-cluster-5.5 (Ubuntu) Status: New = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to mysql-5.5 in Ubuntu. https://bugs.launchpad.net/bugs/1342709 Title: mysql 5.5.38 security update

[Bug 1424129] Re: package python-samba 2:4.1.6+dfsg-1ubuntu2.14.04.6 failed to install/upgrade: package is in a very bad inconsistent state; you should reinstall it before attempting configuration

2015-02-27 Thread Marc Deslauriers
Thank you for using Ubuntu and taking the time to report a bug. Your report should contain, at a minimum, the following information so we can better find the source of the bug and work to resolve it. Submitting the bug about the proper source package is essential. For help see

[Bug 1425141] Re: mod_headers CVE-2013-5704

2015-02-27 Thread Marc Deslauriers
** Information type changed from Private Security to Public Security ** Also affects: apache2 (Ubuntu Precise) Importance: Undecided Status: New ** Also affects: apache2 (Ubuntu Trusty) Importance: Undecided Status: New ** Also affects: apache2 (Ubuntu Lucid) Importance:

[Bug 1423031] Re: NSS incorrectly preferring a longer, weaker chain over a shorter, stronger chain

2015-02-19 Thread Marc Deslauriers
) Importance: Undecided Status: New ** Also affects: nss (Ubuntu Trusty) Importance: Undecided Status: New ** Changed in: nss (Ubuntu Vivid) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: nss (Ubuntu Utopic) Assignee: (unassigned) = Marc Deslauriers

[Bug 1418778] Re: Stack smashing while using a lot of connections

2015-02-06 Thread Marc Deslauriers
Actually, it will be published on monday as we don't typically publish updates on friday. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libfcgi in Ubuntu. https://bugs.launchpad.net/bugs/1418778 Title: Stack smashing while using a

[Bug 1418778] Re: Stack smashing while using a lot of connections

2015-02-06 Thread Marc Deslauriers
ACK on the debdiff. Looks good. Uploaded for building with a slight version change, and will be released today. Thanks! ** Changed in: libfcgi (Ubuntu Precise) Status: Confirmed = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which

[Bug 1418778] Re: Stack smashing while using a lot of connections

2015-02-06 Thread Marc Deslauriers
** Also affects: libfcgi (Ubuntu Precise) Importance: Undecided Status: New ** Changed in: libfcgi (Ubuntu Precise) Status: New = Confirmed ** Changed in: libfcgi (Ubuntu) Status: New = Fix Released -- You received this bug notification because you are a member of

[Bug 1417274] Re: CVE-2015-0221 backport broke serving static content through GZipMiddleware

2015-02-04 Thread Marc Deslauriers
OK, I've now uploaded (1.3.1-4ubuntu1.15) for precise in the same PPA with a less intrusive backport. Could you give it a try, please? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to python-django in Ubuntu.

  1   2   3   4   5   6   7   >