simplestreams (0.1.0~bzr341-0ubuntu2.2) trusty-security; urgency=medium
* SECURITY UPDATE: insufficient verification of GPG signatures
allowing malicious injection into images
- debian/patches/lp1487004-use-checksumming-reader.patch: Ensure
that users of the BasicMirrorWriter get exceptions when importing
data that has invalid checksum or sizes. (LP: #1487004)
- CVE-2015-1337
- debian/patches/lp1487004-sru-safetynet.patch:
provide a backwards compatible behavior via setting
SS_MISSING_ITEM_CHECKSUM_BEHAVIOR=silent. See bug for more info.
Date: 2015-09-24 05:41:16.098493+00:00
Changed-By: Scott Moser <[email protected]>
Signed-By: Steve Beattie <[email protected]>
https://launchpad.net/ubuntu/+source/simplestreams/0.1.0~bzr341-0ubuntu2.2
Sorry, changesfile not available.
--
Trusty-changes mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/trusty-changes
