[Bug 868360] Re: Incorrect secret key causes user details to be revealed

2011-10-25 Thread Jamie Strandboge
Marking public. CVE requested via oss-security. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu. https://bugs.launchpad.net/bugs/868360 Title: Incorrect secret key causes user details to be revealed To manage

[Bug 868360] Re: Incorrect secret key causes user details to be revealed

2011-10-25 Thread Jamie Strandboge
http://www.ubuntu.com/usn/usn-1247-1/ -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu. https://bugs.launchpad.net/bugs/868360 Title: Incorrect secret key causes user details to be revealed To manage notifications

[Bug 868360] Re: Incorrect secret key causes user details to be revealed

2011-10-25 Thread Jamie Strandboge
CVE-2011-4076 has been assigned for this issue. ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2011-4076 -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu. https://bugs.launchpad.net/bugs/868360 Title:

[Bug 810270] Re: AppArmor profiles need updates for /var/run → /run and /var/lock → /run/lock and /dev/shm → /run/shm

2011-10-21 Thread Jamie Strandboge
Jurgen, this sounds like you may have not accepted the changes to /etc/apparmor.d/usr.sbin.mysqld on upgrade. Please look in /etc/apparmor.d/ for *dpkg* files and merge the changes. If this is not the case, please file a new bug with 'ubuntu-bug mysql-5.1'. Thanks -- You received this bug

[Bug 715579] Re: krb5-kdc-ldap plugin crashes krb5-kdc sometimes when password policy is set

2011-10-21 Thread Jamie Strandboge
This should be fixed with http://www.ubuntu.com/usn/usn-1233-1/ ** Changed in: krb5 (Ubuntu) Status: Confirmed = Fix Released -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to krb5 in Ubuntu.

[Bug 858883] Re: Management Parameters (for example a system) which can be set in the web interface can result in arbitrary code execution on the host due to the use of yaml.loads instead of yaml.sa

2011-10-21 Thread Jamie Strandboge
** Changed in: cobbler (Ubuntu Oneiric) Status: New = Triaged ** Changed in: cobbler (Ubuntu Precise) Status: New = Triaged -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to cobbler in Ubuntu.

[Bug 872066] Re: package samba-common-bin 2:3.5.8~dfsg-1ubuntu2 failed to install/upgrade: sistema de ficheros del archivo tar dañado - archivo de paquete dañado

2011-10-21 Thread Jamie Strandboge
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability ** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed

[Bug 871998] Re: package mysql-server-5.1 (not installed) failed to install/upgrade: subprocess new pre-installation script returned error exit status 1

2011-10-21 Thread Jamie Strandboge
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability ** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed

[Bug 858878] Re: lack of csrf protection in cobbler-web

2011-10-21 Thread Jamie Strandboge
** Changed in: cobbler (Ubuntu Precise) Status: New = Triaged ** Changed in: cobbler (Ubuntu Oneiric) Status: New = Triaged -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to cobbler in Ubuntu.

[Bug 874652] Re: package samba 2:3.5.8~dfsg-1ubuntu2.3 failed to install/upgrade: ErrorMessage: package samba is not ready for configuration cannot configure (current status `half-installed')

2011-10-21 Thread Jamie Strandboge
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability ** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed

[Bug 872448] Re: nagios-plugins-standard depend list

2011-10-21 Thread Jamie Strandboge
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 878990] Re: package samba 2:3.5.8~dfsg-1ubuntu2.3 failed to install/upgrade: ErrorMessage: package samba is not ready for configuration cannot configure (current status `half-installed')

2011-10-21 Thread Jamie Strandboge
** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability ** Visibility changed to: Public ** This bug is no longer flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed

[Bug 869553] Re: Apparmor prevents KVM tunnelled migration

2011-10-20 Thread Jamie Strandboge
A workaround for this particular VM is to add the following to /etc/apparmor.d/libvirt/libvirt-4aa60863-6b03-2f19-897f-4de6d12c96e1 (note that I expressly did *not* use /etc/apparmor.d/libvirt/libvirt-4aa60863-6b03-2f19-897f-4de6d12c96e1.files):

[Bug 869553] Re: Apparmor prevents KVM tunnelled migration

2011-10-20 Thread Jamie Strandboge
Simon, That's correct. Without testing it, this patch looks fine. Ideally this would be handled better via the security driver framework, but the latest git seems to indicate this isn't implemented yet, so this would be fine for Precise. So getting this into Ubuntu, the patch should be tested,

[Bug 619712] Re: keepalived vrrp race condition and fix (versions 1.1.17 and 1.2.0 but perhaps all?)

2011-10-19 Thread Jamie Strandboge
This is not fix committed in Ubuntu. A merge with 1:1.2.2-1 from unstable will fix this issue. ** Changed in: keepalived (Ubuntu) Status: Fix Committed = Triaged ** Changed in: keepalived (Ubuntu) Assignee: (unassigned) = Canonical Server Team (canonical-server) ** This bug is no

[Bug 843701] Re: CVE-2011-3190 Apache Tomcat Authentication bypass and information disclosure

2011-10-14 Thread Jamie Strandboge
Removing ubuntu-security-sponsors. tomcat5.5 is processed and tomcat6 is pending in the security ppa. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to tomcat6 in Ubuntu. https://bugs.launchpad.net/bugs/843701 Title: CVE-2011-3190

[Bug 199118]

2011-10-14 Thread Jamie Strandboge
Thank you for reporting this bug to Ubuntu. dapper has reached EOL (End of Life) and is no longer supported. As a result, this bug against dapper is being marked Won't Fix. Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases. Please feel free to report any other

[Bug 491637]

2011-10-14 Thread Jamie Strandboge
Thank you for reporting this bug to Ubuntu. dapper has reached EOL (End of Life) and is no longer supported. As a result, this bug against dapper is being marked Won't Fix. Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases. Please feel free to report any other

[Bug 239129]

2011-10-14 Thread Jamie Strandboge
Thank you for reporting this bug to Ubuntu. dapper has reached EOL (End of Life) and is no longer supported. As a result, this bug against dapper is being marked Won't Fix. Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases. Please feel free to report any other

[Bug 210124]

2011-10-14 Thread Jamie Strandboge
Thank you for reporting this bug to Ubuntu. dapper has reached EOL (End of Life) and is no longer supported. As a result, this bug against dapper is being marked Won't Fix. Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases. Please feel free to report any other

[Bug 173967]

2011-10-14 Thread Jamie Strandboge
Thank you for reporting this bug to Ubuntu. dapper has reached EOL (End of Life) and is no longer supported. As a result, this bug against dapper is being marked Won't Fix. Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases. Please feel free to report any other

[Bug 727837]

2011-10-14 Thread Jamie Strandboge
Thank you for reporting this bug to Ubuntu. dapper has reached EOL (End of Life) and is no longer supported. As a result, this bug against dapper is being marked Won't Fix. Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases. Please feel free to report any other

[Bug 727837]

2011-10-14 Thread Jamie Strandboge
Thank you for reporting this bug to Ubuntu. karmic has reached EOL (End of Life) and is no longer supported. As a result, this bug against karmic is being marked Won't Fix. Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases. Please feel free to report any other

[Bug 705014]

2011-10-14 Thread Jamie Strandboge
Thank you for reporting this bug to Ubuntu. karmic has reached EOL (End of Life) and is no longer supported. As a result, this bug against karmic is being marked Won't Fix. Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases. Please feel free to report any other

[Bug 94681]

2011-10-14 Thread Jamie Strandboge
Thank you for reporting this bug to Ubuntu. dapper has reached EOL (End of Life) and is no longer supported. As a result, this bug against dapper is being marked Won't Fix. Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases. Please feel free to report any other

[Bug 239129]

2011-10-14 Thread Jamie Strandboge
Thank you for reporting this bug to Ubuntu. dapper has reached EOL (End of Life) and is no longer supported. As a result, this bug against dapper is being marked Won't Fix. Please see https://wiki.ubuntu.com/Releases for currently supported Ubuntu releases. Please feel free to report any other

[Bug 872000] [NEW] /etc/apache2/mods-available/suexec.load has group read

2011-10-10 Thread Jamie Strandboge
Public bug reported: $ ls -l /etc/apache2/mods-available/suexec.load -rw-rw-r-- 1 root root 64 2011-09-06 13:38 /etc/apache2/mods-available/suexec.load While this is not security-relevant, it is also not desirable. What happened is that the default umask changed fro 0002 to 0022 in 11.10

[Bug 858878] Re: lack of csrf protection in cobbler-web

2011-10-09 Thread Jamie Strandboge
While this is targeted for Precise, it also is going to need to be backported to Oneiric as this is a security vulnerability. ** Also affects: cobbler (Ubuntu Oneiric) Importance: High Status: New ** Also affects: cobbler (Ubuntu Precise) Importance: Undecided Status: New **

[Bug 869553] Re: Apparmor prevents KVM tunnelled migration

2011-10-08 Thread Jamie Strandboge
This is not an appropriate rule because it negates the property of guest isolation. This should be handled dynamically by the security driver, but it is not (which is the bug). This could be done in a couple of ways. What are the contents of /var/log/libvirt/qemu/guest1.log after the AppArmor

[Bug 457163] Re: virsh lacks bash completion

2011-10-05 Thread Jamie Strandboge
Serge, Not having looked at the file, just dropping a file into /etc/bash_completion.d is totally fine and is an easy packaging change without a huge Ubuntu delta. We should send upstream and to Debian, but I don't think we need to block on it. -- You received this bug notification because you

[Bug 861182] Re: Remote directory traversal, allows write to arbitrary locations

2011-10-05 Thread Jamie Strandboge
** Visibility changed to: Public ** Changed in: puppet (Ubuntu Hardy) Status: Confirmed = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to puppet in Ubuntu. https://bugs.launchpad.net/bugs/861182 Title: Remote

[Bug 861182] Re: Remote directory traversal, allows write to arbitrary locations

2011-10-05 Thread Jamie Strandboge
Marking bug as public, since the issue is public now. I have uploaded untested hardy packages for this and the other CVE that affects hardy to https://launchpad.net/~ubuntu-security-proposed/+archive/ppa/+packages. These patches came from upstream and applied cleanly. Since this is in universe,

[Bug 861182] Re: Remote directory traversal, allows write to arbitrary locations

2011-10-05 Thread Jamie Strandboge
Pocket copied puppet to hardy-proposed. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Thank you in advance! ** Tags removed: security-verification ** Tags added: verification-needed ** Description

[Bug 861182] Re: Remote directory traversal, allows write to arbitrary locations

2011-10-05 Thread Jamie Strandboge
To ubuntu-sru: if this passes the verification process, please also pocket copy to security. Thanks! -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to puppet in Ubuntu. https://bugs.launchpad.net/bugs/861182 Title: Remote directory

[Bug 865462] Re: Upgrade to 0.25.4-2ubuntu6.3 introduces http://projects.puppetlabs.com/issues/3922

2011-10-04 Thread Jamie Strandboge
) = Jamie Strandboge (jdstrand) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to puppet in Ubuntu. https://bugs.launchpad.net/bugs/865462 Title: Upgrade to 0.25.4-2ubuntu6.3 introduces http://projects.puppetlabs.com/issues/3922

[Bug 865462] Re: Upgrade to 0.25.4-2ubuntu6.3 introduces http://projects.puppetlabs.com/issues/3922

2011-10-04 Thread Jamie Strandboge
I uploaded a new puppet for Lucid to the ubuntu-security-proposed ppa (https://launchpad.net/~ubuntu-security- proposed/+archive/ppa/+packages). Can someone affected by this bug comment on if the updated packages fixes the issue? You can fetch specific binaries at:

[Bug 865462] Re: Upgrade to 0.25.4-2ubuntu6.3 introduces http://projects.puppetlabs.com/issues/3922

2011-10-04 Thread Jamie Strandboge
** Also affects: puppet (Ubuntu Lucid) Importance: Undecided Status: New ** Also affects: puppet (Ubuntu Oneiric) Importance: High Assignee: Jamie Strandboge (jdstrand) Status: In Progress ** Changed in: puppet (Ubuntu Lucid) Status: New = Fix Committed

[Bug 865515] Re: virtual machines should not have nat on servers

2011-10-04 Thread Jamie Strandboge
I agree the default of nat is appropriate for desktops and I feel quite strongly it should not change there. The default for servers is probably better as non-nat (though this could be debated), as this bug suggests. However having different behavior depending on the type of system it is would

[Bug 865515] Re: virtual machines should not have nat on servers

2011-10-04 Thread Jamie Strandboge
** Changed in: libvirt (Ubuntu) Status: Incomplete = New -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libvirt in Ubuntu. https://bugs.launchpad.net/bugs/865515 Title: virtual machines should not have nat on servers To

[Bug 863305] Re: Image access control is available

2011-09-30 Thread Jamie Strandboge
** This bug has been flagged as a security vulnerability -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu. https://bugs.launchpad.net/bugs/863305 Title: Image access control is available To manage notifications about

[Bug 854899] Re: [FFe] Update to puppet-2.7.3

2011-09-30 Thread Jamie Strandboge
This should be updated to 2.7.5 or to include the patches in http://www.ubuntu.com/usn/usn-1223-1/. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to puppet in Ubuntu. https://bugs.launchpad.net/bugs/854899 Title: [FFe] Update to

[Bug 854899] Re: [FFe] Update to puppet-2.7.3

2011-09-29 Thread Jamie Strandboge
This should be updated to 2.7.4 or to include the patch in http://www.ubuntu.com/usn/usn-1217-1/. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to puppet in Ubuntu. https://bugs.launchpad.net/bugs/854899 Title: [FFe] Update to

[Bug 862558] [NEW] cobbler-enlist is not checking for return codes enough

2011-09-29 Thread Jamie Strandboge
Public bug reported: In performing the MIR audit for cobbler-enlist (bug #860492), I discovred: - PROBLEM: most xmlrpc_* calls are not doing any error checking, but should be based on looking at code of xmlrpc-c. - RECOMMENDATION: create utility function wrappers for the common xmlrpc-c

[Bug 862567] [NEW] debconf and documentation should mention lack of SSL

2011-09-29 Thread Jamie Strandboge
Public bug reported: During the review of cobbler-enlist, it was noted that cobbler-enlist doesn't use SSL. This should be documented as such: - adjusting the already existing debconf questions/notes to include language that the information is currently submitted in unencrypted form (and a way

[Bug 860492] Re: [MIR] cobbler-enlist src, cobbler-enlist-udeb bin

2011-09-29 Thread Jamie Strandboge
...please feel free to promote and seed once bug #862567 is fixed. should have read: ...please feel free to seed and promote source and binaries once bug #862567 is fixed. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to cobbler-enlist

[Bug 860492] Re: [MIR] cobbler-enlist src, cobbler-enlist-udeb bin

2011-09-29 Thread Jamie Strandboge
Marking as 'In Progress' since this is pending bug #862567. ** Changed in: cobbler-enlist (Ubuntu Oneiric) Status: Confirmed = In Progress -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to cobbler-enlist in Ubuntu.

[Bug 860492] Re: [MIR] cobbler-enlist src, cobbler-enlist-udeb bin

2011-09-29 Thread Jamie Strandboge
(Ubuntu Oneiric) Assignee: Jamie Strandboge (jdstrand) = (unassigned) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to cobbler-enlist in Ubuntu. https://bugs.launchpad.net/bugs/860492 Title: [MIR] cobbler-enlist src, cobbler-enlist

[Bug 860492] Re: [MIR] cobbler-enlist source and binaries

2011-09-29 Thread Jamie Strandboge
Bug #862567 is fixed. Please feel free to seed in main. ** Summary changed: - [MIR] cobbler-enlist src, cobbler-enlist-udeb bin + [MIR] cobbler-enlist source and binaries ** Changed in: cobbler-enlist (Ubuntu Oneiric) Status: In Progress = Fix Committed -- You received this bug

[Bug 832507] Re: console.log grows indefinitely

2011-09-27 Thread Jamie Strandboge
** Changed in: libvirt (Ubuntu) Status: In Progress = Fix Committed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu. https://bugs.launchpad.net/bugs/832507 Title: console.log grows indefinitely To manage

[Bug 843701] Re: CVE-2011-3190 Apache Tomcat Authentication bypass and information disclosure

2011-09-26 Thread Jamie Strandboge
Unsubscribing ubuntu-security-sponsors since Marc is handling this as part of his update. ** Changed in: tomcat6 (Ubuntu Lucid) Status: New = In Progress ** Changed in: tomcat6 (Ubuntu Lucid) Assignee: (unassigned) = Marc Deslauriers (mdeslaur) ** Changed in: tomcat6 (Ubuntu

[Bug 813115] Re: CVE-2011-2202

2011-09-26 Thread Jamie Strandboge
Unsubscribing ubuntu-security-sponsors since Steve is handling this as part of his update. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/813115 Title: CVE-2011-2202 To manage

[Bug 813110] Re: CVE-2011-1938

2011-09-26 Thread Jamie Strandboge
Unsubscribing ubuntu-security-sponsors since Steve is handling this as part of his update. ** Changed in: php5 (Ubuntu Lucid) Status: Confirmed = In Progress ** Changed in: php5 (Ubuntu Lucid) Assignee: (unassigned) = Steve Beattie (sbeattie) ** Changed in: php5 (Ubuntu Maverick)

[Bug 832507] Re: console.log grows indefinitely

2011-09-26 Thread Jamie Strandboge
** Changed in: libvirt (Ubuntu) Status: Triaged = In Progress -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu. https://bugs.launchpad.net/bugs/832507 Title: console.log grows indefinitely To manage

[Bug 832507] Re: console.log grows indefinitely

2011-09-23 Thread Jamie Strandboge
** Tags added: apparmor ** Also affects: libvirt (Ubuntu) Importance: Undecided Status: New ** Changed in: libvirt (Ubuntu) Status: New = Triaged ** Changed in: libvirt (Ubuntu) Importance: Undecided = High ** Changed in: libvirt (Ubuntu) Assignee: (unassigned) = Jamie

[Bug 852885] Re: PHP rfc1867_post_handler File Path Injection Vulnerability

2011-09-23 Thread Jamie Strandboge
** Visibility changed to: Public -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/852885 Title: PHP rfc1867_post_handler File Path Injection Vulnerability To manage notifications about

[Bug 852871] Re: PHP ZEND_SL Opcode Interruption Address Information Leak Vulnerability

2011-09-23 Thread Jamie Strandboge
** Visibility changed to: Public -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/852871 Title: PHP ZEND_SL Opcode Interruption Address Information Leak Vulnerability To manage

[Bug 852848] Re: MOPS-2010-006: PHP addcslashes() Interruption Information Leak Vulnerability

2011-09-23 Thread Jamie Strandboge
Thank you for using Ubuntu and reporting a bug. More information about this issue can be found in http://people.canonical.com/~ubuntu- security/cve/2010/CVE-2010-1864.html ** Changed in: php5 (Ubuntu) Status: New = Fix Released ** Visibility changed to: Public -- You received this bug

[Bug 852868] Re: php5 var_export() information leak

2011-09-23 Thread Jamie Strandboge
** Visibility changed to: Public -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/852868 Title: php5 var_export() information leak To manage notifications about this bug go to:

[Bug 852847] Re: MOPS-2010-008: PHP chunk_split() Interruption Information Leak Vulnerability

2011-09-23 Thread Jamie Strandboge
Thank you for using Ubuntu and reporting a bug. More information about this issue can be found in http://people.canonical.com/~ubuntu- security/cve/2010/CVE-2010-1862.html ** Visibility changed to: Public ** Changed in: php5 (Ubuntu) Status: New = Fix Released -- You received this bug

[Bug 852913] Re: PHP trim()/ltrim()/rtrim() Interruption Information Leak Vulnerability

2011-09-23 Thread Jamie Strandboge
Thank you for using Ubuntu and reporting a bug. More information about this issue can be found in http://people.canonical.com/~ubuntu- security/cve/2010/CVE-2010-2190.html ** Visibility changed to: Public ** Changed in: php5 (Ubuntu) Status: New = Fix Released -- You received this bug

[Bug 852916] Re: http://php-security.org/2010/05/31/mops-2010-054-php-zend_concatzend_assign_concat-opcode-interruption-information-leak-and-memory-corruption-vulnerability/index.html

2011-09-23 Thread Jamie Strandboge
Thank you for using Ubuntu and reporting a bug. More information about this issue can be found in http://people.canonical.com/~ubuntu- security/cve/2010/CVE-2010-2191.html ** Visibility changed to: Public ** Changed in: php5 (Ubuntu) Status: New = Fix Released -- You received this bug

[Bug 852910] Re: PHP Magic Quotes Fails to Protect mysqli_fetch_assoc

2011-09-23 Thread Jamie Strandboge
** Changed in: php5 (Ubuntu) Status: New = Confirmed ** Changed in: php5 (Ubuntu) Assignee: (unassigned) = Steve Beattie (sbeattie) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu.

[Bug 852907] Re: PHP Iconv Improper Handling of Unrecognized Encodings

2011-09-23 Thread Jamie Strandboge
Thank you for using Ubuntu and reporting a bug. More information about this issue can be found in http://people.canonical.com/~ubuntu- security/cve/2010/CVE-2010-4699.html ** Visibility changed to: Public ** Changed in: php5 (Ubuntu) Status: New = Fix Released -- You received this bug

[Bug 852885] Re: PHP rfc1867_post_handler File Path Injection Vulnerability

2011-09-23 Thread Jamie Strandboge
** Changed in: php5 (Ubuntu) Status: New = Confirmed ** Changed in: php5 (Ubuntu) Assignee: (unassigned) = Steve Beattie (sbeattie) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu.

[Bug 852871] Re: PHP ZEND_SL Opcode Interruption Address Information Leak Vulnerability

2011-09-23 Thread Jamie Strandboge
** Changed in: php5 (Ubuntu) Status: New = Confirmed ** Changed in: php5 (Ubuntu) Assignee: (unassigned) = Steve Beattie (sbeattie) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu.

[Bug 852865] Re: strrchr() functions information leak

2011-09-23 Thread Jamie Strandboge
http://permalink.gmane.org/gmane.comp.security.oss.general/3109 ** Visibility changed to: Public ** Changed in: php5 (Ubuntu) Status: New = Confirmed ** Changed in: php5 (Ubuntu) Assignee: (unassigned) = Steve Beattie (sbeattie) -- You received this bug notification because you

[Bug 852868] Re: php5 var_export() information leak

2011-09-23 Thread Jamie Strandboge
** Changed in: php5 (Ubuntu) Status: New = Confirmed ** Changed in: php5 (Ubuntu) Assignee: (unassigned) = Steve Beattie (sbeattie) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu.

[Bug 852910] Re: PHP Magic Quotes Fails to Protect mysqli_fetch_assoc

2011-09-23 Thread Jamie Strandboge
** Visibility changed to: Public -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to php5 in Ubuntu. https://bugs.launchpad.net/bugs/852910 Title: PHP Magic Quotes Fails to Protect mysqli_fetch_assoc To manage notifications about this

[Bug 852853] Re: CVE-2010-2101

2011-09-23 Thread Jamie Strandboge
Thank you for using Ubuntu and reporting a bug. More information about this issue can be found in http://people.canonical.com/~ubuntu- security/cve/2010/CVE-2010-2101.html ** Changed in: php5 (Ubuntu) Status: New = Fix Released ** Visibility changed to: Public -- You received this bug

[Bug 829234] Re: [MIR] socat

2011-09-21 Thread Jamie Strandboge
I'll answer my own question, from nova/virt/libvirt/connection.py: def get_pty_for_instance(instance_name): virt_dom = self._lookup_by_name(instance_name) xml = virt_dom.XMLDesc(0) dom = minidom.parseString(xml) for serial in

[Bug 829234] Re: [MIR] socat

2011-09-21 Thread Jamie Strandboge
, etc ** Changed in: socat (Ubuntu) Assignee: Jamie Strandboge (jdstrand) = (unassigned) ** Changed in: socat (Ubuntu) Status: In Progress = Confirmed -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to socat in Ubuntu. https

[Bug 829234] Re: [MIR] socat

2011-09-21 Thread Jamie Strandboge
I should mention that performing input validation on get_pty_for_instance() and dropping privileges would be enough to 'solve' the immediate issues with nova's use of socat, but the other suggestions are for future-proofing against the new (and presumably rapidly changing) nova codebase and for

[Bug 829234] Re: [MIR] socat

2011-09-20 Thread Jamie Strandboge
** Changed in: socat (Ubuntu) Assignee: Ubuntu Security Team (ubuntu-security) = Jamie Strandboge (jdstrand) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to socat in Ubuntu. https://bugs.launchpad.net/bugs/829234 Title: [MIR

[Bug 829234] Re: [MIR] socat

2011-09-20 Thread Jamie Strandboge
I'm still reviewing this, but there is a lot of overlap between socat and netcat, and I wonder what specific features of socat are required over netcat. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to socat in Ubuntu.

[Bug 829234] Re: [MIR] socat

2011-09-16 Thread Jamie Strandboge
** Changed in: socat (Ubuntu) Assignee: Canonical Security Team (canonical-security) = Ubuntu Security Team (ubuntu-security) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to socat in Ubuntu. https://bugs.launchpad.net/bugs/829234

[Bug 801501] Re: [MIR] nova

2011-09-16 Thread Jamie Strandboge
Thanks Dave. This is satisfactory to the security team. Please continue to work with upstream on the 'sudoers problem' so that can be resolved for 12.04. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu.

[Bug 801501] Re: [MIR] nova

2011-09-15 Thread Jamie Strandboge
** Changed in: nova (Ubuntu) Assignee: Ubuntu Security Team (ubuntu-security) = (unassigned) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to nova in Ubuntu. https://bugs.launchpad.net/bugs/801501 Title: [MIR] nova To manage

[Bug 801501] Re: [MIR] nova

2011-09-14 Thread Jamie Strandboge
Kees and I discussed this today, so I will summarize the conversation (keep in mind I have not reviewed the code personally and Kees only performed a shallow audit): * Size and scope: nova is a very large and complex piece of software with many daemons listening on the network and there is too

[Bug 828789] Re: [FFE] please enable spice support

2011-09-14 Thread Jamie Strandboge
This needs an ACK from ubuntu-release at this time. Unsubscribing ubuntu-sponsors. Once you have the ACK, please resubscribe. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to qemu-kvm in Ubuntu. https://bugs.launchpad.net/bugs/828789

[Bug 840386] Re: Update munin to bugfix release 1.4.6

2011-09-14 Thread Jamie Strandboge
Thanks Daniel for the debdiff. I am going to NAK this version because the changelog did not capture all of the changes in the bug: * debian/munin-node.dirs is updated for upstart * upstream_bug_832.patch is added * upstream_add-timeout-to-legal-options.patch is added Also the following Ubuntu

[Bug 843701] Re: CVE-2011-3190 Apache Tomcat Authentication bypass and information disclosure

2011-09-08 Thread Jamie Strandboge
tomcat7 was fixed in 7.0.21-1. ** Changed in: tomcat6 (Ubuntu) Status: New = Confirmed ** Changed in: tomcat7 (Ubuntu) Status: New = Confirmed ** Changed in: tomcat7 (Ubuntu) Status: Confirmed = Fix Released -- You received this bug notification because you are a member

[Bug 828792] Re: [FFE] Merge 0.9.3-5 from debian unstable

2011-09-08 Thread Jamie Strandboge
I don't think it is the apparmor security driver code based on where the error is occurring and the test output: Test initialization ... (default:default, qemu:///session, apparmor=False) ... FAIL The apparmor driver is disabled and it is still failing (granted, in the session code). -- You

[Bug 828792] Re: [FFE] Merge 0.9.3-5 from debian unstable

2011-09-08 Thread Jamie Strandboge
I should also note I am not actively investigating this issue at present. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libvirt in Ubuntu. https://bugs.launchpad.net/bugs/828792 Title: [FFE] Merge 0.9.3-5 from debian unstable To

[Bug 840925] Re: Please make /dev/kvm world-accessible in 45-qemu-kvm.rules

2011-09-07 Thread Jamie Strandboge
What specifically were these reasons? When did they no longer become a concern and why? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to kvm in Ubuntu. https://bugs.launchpad.net/bugs/840925 Title: Please make /dev/kvm

[Bug 840925] Re: Please make /dev/kvm world-accessible in 45-qemu-kvm.rules

2011-09-07 Thread Jamie Strandboge
** Changed in: kvm (Ubuntu) Status: New = Incomplete ** Changed in: kvm (Ubuntu) Assignee: (unassigned) = Jamie Strandboge (jdstrand) -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to kvm in Ubuntu. https

[Bug 828792] Re: [FFE] Merge 0.9.3-5 from debian unstable

2011-09-06 Thread Jamie Strandboge
This points to the failure happening before the dynamic profile is generated. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libvirt in Ubuntu. https://bugs.launchpad.net/bugs/828792 Title: [FFE] Merge 0.9.3-5 from debian unstable

[Bug 694029] Re: kvm guests become unstable after a while

2011-09-06 Thread Jamie Strandboge
I am happy to report that for the last several weeks this bug seems to be fixed. It appears to coincide with either linux-firmware 1.60 (possibly 1.59, since I went from 1.58 straight to 1.60) or linux 3.0.0-9.13 (or 3.0.0-9.12). I did updates around 2011-08-23 and found this bug is no longer a

[Bug 828792] Re: [FFE] Merge 0.9.3-5 from debian unstable

2011-09-02 Thread Jamie Strandboge
This is an interesting error: error: Failed to connect socket to '@/home/tucxnXJm/.libvirt/libvirt-sock': Connection refused error: failed to connect to the hypervisor This is a new location of the socket. Do you have any apparmor denials in kern.log? -- You received this bug notification

[Bug 607466] Re: libvirt error starting domin: could not remove profile for

2011-08-29 Thread Jamie Strandboge
Sven, what version of libvirt and Ubuntu are you using? Can you attach the output of 'virsh dumpxml your problem domain'? Thanks -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libvirt in Ubuntu. https://bugs.launchpad.net/bugs/607466

[Bug 834967] Re: package mysql-server-5.1 5.1.54-1ubuntu4 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1

2011-08-26 Thread Jamie Strandboge
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a regular (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross

[Bug 307204] Re: [jaunty] option rfc3442-classless-static-routes causes missing routes

2011-08-24 Thread Jamie Strandboge
Marking fixed as per comment #20. Roy and oliver, if you are still having your issues, please file a new bug. ** Changed in: dhcp (Ubuntu) Status: New = Fix Released ** Changed in: dhcp3 (Ubuntu) Status: Confirmed = Fix Released -- You received this bug notification because you

[Bug 828792] Re: [FFE] Merge 0.9.3-5 from debian unstable

2011-08-23 Thread Jamie Strandboge
Does this pass QRT? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libvirt in Ubuntu. https://bugs.launchpad.net/bugs/828792 Title: [FFE] Merge 0.9.3-5 from debian unstable To manage notifications about this bug go to:

[Bug 229632] Re: ntpd should run niced

2011-08-19 Thread Jamie Strandboge
This can be added to the apparmor profile to allow -N option to work: capability sys_nice, Then run: $ sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.ntpd I'm preparing an upload for this policy change now. -- You received this bug notification because you are a member of Ubuntu Server

[Bug 229632] Re: ntpd should run niced

2011-08-19 Thread Jamie Strandboge
ntp (1:4.2.6.p2+dfsg-1ubuntu11) oneiric; urgency=low * debian/apparmor-profile: allow sys_nice for -N option to work. More work is needed to make ntpd start niced, so not auto-closing the bug. - LP: 229632 -- You received this bug notification because you are a member of Ubuntu Server

[Bug 694029] Re: kvm guests become unstable after a while

2011-08-19 Thread Jamie Strandboge
Removing '[natty]' from description as this affects oneiric too, and the bug is targeted to both natty and oneiric already. ** Summary changed: - [natty] kvm guests become unstable after a while + kvm guests become unstable after a while -- You received this bug notification because you are a

[Bug 829089] Re: clamd scanning mimedefang temp files blocked by apparmor

2011-08-19 Thread Jamie Strandboge
I'm not up on current mimedefang, but doing something like this would be even better: /var/spool/MIMEDefang/mdefang-*/Work/ r, /var/spool/MIMEDefang/mdefang-*/Work/** r, If mimedefang's spool directory only contains the files to be scanned, then the easier to maintain

[Bug 829089] Re: clamd scanning mimedefang temp files blocked by apparmor

2011-08-19 Thread Jamie Strandboge
'/var/spool/MIMEDefang/** r,' looks good. It is similar for what we are doing with all the others (amavis, havp, etc). -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to clamav in Ubuntu. https://bugs.launchpad.net/bugs/829089 Title:

[Bug 632696] Re: libvirt won't start a VM with serial or console when apparmor is enabled

2011-08-18 Thread Jamie Strandboge
Based on Thomas' assessment, should the title of this bug be adjusted and the apparmor tag removed? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libvirt in Ubuntu. https://bugs.launchpad.net/bugs/632696 Title: libvirt won't start

[Bug 828792] Re: [FFE] Please sync from debian unstable

2011-08-18 Thread Jamie Strandboge
libvirt has a significant Ubuntu delta, not least of which is adjusting it for AppArmor, apport, libvirt-migrate-qemu-disks (needed until 12.04), different groups, openiscsi, etc, etc. Glancing at the Debian changelog, these have not been upstreamed. AFAICT, this should be an FFe for a merge, not

[Bug 632696] Re: libvirt won't start a VM with serial or console when apparmor is enabled

2011-08-18 Thread Jamie Strandboge
Serge, but comment #25 by Thomas said he is having the problem even with AppArmor disabled... -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to libvirt in Ubuntu. https://bugs.launchpad.net/bugs/632696 Title: libvirt won't start a VM

<    2   3   4   5   6   7   8   9   10   11   >