~ubuntu-branches/ubuntu/precise/puppet/precise-proposed : changes

~ubuntu-branches/ubuntu/precise/puppet/precise-proposed » Changes from revision 68

From Revision 68 to 49

Rev	Summary	Authors	Tags	Date
68	debian/patches/2.7.11-remove-process_name-performance.patch: debian/patches/2.7.11-remove-process_name-performance.patch: Fixes performance regression caused by a thread that loops forever in order to change a process name when told so (LP: #995719)	Adam Stokes	2.7.11-1ubuntu2.5	10 years ago
67	* SECURITY UPDATE: August 2013 privilege escalation and code... * SECURITY UPDATE: August 2013 privilege escalation and code execution vulnerabilities - debian/patches/ubuntu-2.7.11-puppet-Aug-2013-CVE-fixes.patch: upstream patch to resolve security issues. - CVE-2013-4956 - CVE-2013-4761	Marc Deslauriers	2.7.11-1ubuntu2.4	10 years ago
66	* SECURITY UPDATE: Remote code execution on master from unau... * SECURITY UPDATE: Remote code execution on master from unauthenticated clients - debian/patches/2.7.21-Patch-for-CVE-2013-3567.patch: upstream patch to use safe_yama. - CVE-2013-3567	Marc Deslauriers	2.7.11-1ubuntu2.3	10 years ago
65	* SECURITY UPDATE: Multiple security issues * SECURITY UPDATE: Multiple security issues - debian/patches/security-mar-2013.patch: upstream patch to fix multiple security issues. - CVE-2013-1640 - Remote code execution on master from authenticated clients - CVE-2013-1652 - Insufficient input validation - CVE-2013-1653 - Remote code execution - CVE-2013-1654 - Protocol downgrade - CVE-2013-1655 - Unauthenticated remote code execution risk - CVE-2013-2275 - Incorrect default report ACL	Marc Deslauriers	2.7.11-1ubuntu2.2	11 years ago
64	* SECURITY UPDATE: Multiple July 2012 security issues * SECURITY UPDATE: Multiple July 2012 security issues - debian/patches/2.7.17-Puppet-July-2012-CVE-fixes.patch: upstream patch to fix multiple security issues. - CVE-2012-3864: arbitrary file read on master from authenticated clients - CVE-2012-3865: arbitrary file delete or denial of service on master from authenticated clients - CVE-2012-3866: last_run_report.yaml report file is world readable and leads to arbitrary file read on master by an agent - CVE-2012-3867: insufficient input validation for agent cert hostnames	Marc Deslauriers	2.7.11-1ubuntu2.1	11 years ago
63	* SECURITY UPDATE: Arbitrary file writes via predictable fil... * SECURITY UPDATE: Arbitrary file writes via predictable filename usage in appdmg and pkgdmg providers (LP: #978708) - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch - CVE-2012-1906 * SECURITY UPDATE: Arbitrary file reads via Filebucket REST requests - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch - CVE-2012-1986 * SECURITY UPDATE: Denial of service via Filebucket text/marshall support - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch - CVE-2012-1987 * SECURITY UPDATE: Arbitrary code execution via Filebucket requests - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch - CVE-2012-1988 * SECURITY UPDATE: Arbritrary file writes via predictable telnet output log filename - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch - CVE-2012-1989 * debian/patches/puppet-12844: Re-fetch the patch from upstream since some missing pieces cause 'rake spec' to abort immediately	Tyler Hicks	2.7.11-1ubuntu2	12 years ago
62	[ Marc Cluet ] [ Marc Cluet ] * debian/patches/puppet-12844: Cherry picked patch from upstream 2.7.12 to revert new agent lockfile behaviour as it breaks upgrades from versions < 2.7.10. This feature has been pushed out to puppet 3.x by upstream. * debian/puppetmaster-passenger.postinst (LP: #948983) - Fixed rack directory location - Added proper enabling of apache2 headers mod * debian/puppetmaster-passenger.postinst (LP: #950183) - Make sure we error if puppet config print doesn't work [ James Page ] * debian/puppetmaster-passenger.postinst: - Ensure upgrades from <= 2.7.11-1 fixup passenger apache configuration.	Marc Cluet	2.7.11-1ubuntu1	12 years ago
61	* New upstream release * New upstream release * Urgency set to high due to regressions in previous release and security vulnerabilities * Execs when run with a user specified, but no group, get the root group. Similarly unexpected privileges are given to providers and types (egid remains as root), this is fixed with a patch from upstream (CVE-2012-1053) * Fix Klogin write through symlink (CVE-2012-1054)	Micah Anderson	2.7.11-1	12 years ago
60	Use maintscript support in dh_installdeb rather than writing... Use maintscript support in dh_installdeb rather than writing out dpkg-maintscript-helper commands by hand. We now simply Pre-Depend on a new enough version of dpkg rather than using 'dpkg-maintscript-helper supports' guards, leading to more predictable behaviour on upgrades.	Colin Watson	2.7.10-1ubuntu1	12 years ago
59	* New upstream release * New upstream release * Update breaks/replaces for puppetmaster-common (Closes: #656962) * Add systemd services for puppet agent and master	Stig Sandbeck Mathis...	2.7.10-1	12 years ago
58	Use maintscript support in dh_installdeb rather than writing... Use maintscript support in dh_installdeb rather than writing out dpkg-maintscript-helper commands by hand. We now simply Pre-Depend on a new enough version of dpkg rather than using 'dpkg-maintscript-helper supports' guards, leading to more predictable behaviour on upgrades.	Colin Watson	2.7.9-1ubuntu2	12 years ago
57	* Merge from Debian testing. Remaining changes: * Merge from Debian testing. Remaining changes: + Add 2 patches to fix incompatibility with Augeas 0.10.0: - augeas_saved_files - augeas_versioncmp + Change Maintainer according to policy	Chuck Short	2.7.9-1ubuntu1	12 years ago
56	* Add 2 patches to fix incompatibility with Augeas 0.10.0: * Add 2 patches to fix incompatibility with Augeas 0.10.0: - augeas_saved_files - augeas_versioncmp * Change Maintainer according to policy.	Raphaël Pinson	2.7.6-1ubuntu1	12 years ago
55	* New upstream release (CVE-2011-3872) * New upstream release (CVE-2011-3872) * Remove cherry-picked "groupadd_aix_warning" patch * Install all new manpages	Stig Sandbeck Mathis...	2.7.6-1	12 years ago
54	* SECURITY UPDATE: puppet master impersonation via incorrect... * SECURITY UPDATE: puppet master impersonation via incorrect certificates - debian/patches/CVE-2011-3872.patch: refactor certificate handling. - Thanks to upstream for providing the patch. - CVE-2011-3872	Marc Deslauriers	2.7.1-1ubuntu3.2	12 years ago
53	* SECURITY UPDATE: k5login can overwrite arbitrary files as ... * SECURITY UPDATE: k5login can overwrite arbitrary files as root - debian/patches/CVE-2011-3869.patch: adjust type/k5login.rb to securely open the file before writing to it as root - CVE-2011-3869 * SECURITY UPDATE: didn't drop privileges before creating and changing permissions on SSH keys - debian/patches/CVE-2011-3870.patch: adjust ssh_authorized_key/parsed.rb to drop privileges before creating the ssh directory and setting permissions - CVE-2011-3870 * SECURITY UPDATE: fix predictable temporary filename in ralsh - debian/patches/CVE-2011-3871.patch: adjust application/resource.rb to use an unpredictable filename - CVE-2011-3871 * SECURITY UPDATE: file indirector injection, similar to CVE-2011-3848 - secure-indirector-file-backed-terminus-base-cla.patch: Since the indirector file backed terminus base class is only used by the test suite, remove it and update test cases to use a continuing class.	Jamie Strandboge	2.7.1-1ubuntu3	12 years ago
52	* SECURITY UPDATE: unauthenticated directory traversal allow... * SECURITY UPDATE: unauthenticated directory traversal allows writing of arbitrary files as puppet master - debian/patches/CVE-2011-3848.patch: update lib/puppet/indirector.rb, lib/puppet/indirector/ssl_file.rb, lib/puppet/indirector/yaml.rb, spec/unit/indirector/ssl_file.rb and spec/unit/indirector/yaml.rb to perform proper input validation. - CVE-2011-3848 - LP: #861182	Jamie Strandboge	2.7.1-1ubuntu2	12 years ago
51	* Merge from debian unstable. Remaining changes: * Merge from debian unstable. Remaining changes: - debian/puppetmaster-passenger.postinst: Use cacrl instead of hostcrl to set the location of the CRL in apache2 configuration. Fix apache2 configuration on upgrade as well (LP: #641001) - move all puppet dependencies to puppet-common since all the code actually located in puppet-common. - move libagueas from a recommend to a dependency.	Chuck Short	2.7.1-1ubuntu1	12 years ago
50	* Merge from debian unstable. Remaining changes: * Merge from debian unstable. Remaining changes: - debian/puppetmaster-passenger.postinst: Use cacrl instead of hostcrl to set the location of the CRL in apache2 configuration. Fix apache2 configuration on upgrade as well (LP: #641001) - move all puppet dependencies to puppet-common since all the code actually located in puppet-common. - move libagueas from a recommend to a dependency.	Chuck Short	2.6.8-1ubuntu1	13 years ago
49	releasing version 2.6.4-2ubuntu2 releasing version 2.6.4-2ubuntu2	Dave Walker (Daviey)	2.6.4-2ubuntu2	13 years ago

Older »