~ubuntu-branches/ubuntu/quantal/keystone/quantal-updates : changes

~ubuntu-branches/ubuntu/quantal/keystone/quantal-updates » Changes from revision 43

From Revision 43 to 24

Rev	Summary	Authors	Tags	Date
43	* SECURITY UPDATE: revoke user tokens when disabling/delete ... * SECURITY UPDATE: revoke user tokens when disabling/delete a project - debian/patches/CVE-2013-4222.patch: add _delete_tokens_for_project() to common/controller.py and use it in identity/controllers.py (LP: #1179955) - CVE-2013-4222 * SECURITY UPDATE: fix and test token revocation list API - debian/patches/CVE-2013-4294.patch: fix token matching for memcache backend token revocation (LP: #1202952) - CVE-2013-4294	Jamie Strandboge	2012.2.4-0ubuntu3.2	10 years ago
42	* SECURITY UPDATE: fix auth_token middleware neglects to che... * SECURITY UPDATE: fix auth_token middleware neglects to check expiry of signed token when using PKI - debian/patches/CVE-2013-2104.patch: explicitly check the expiry on the tokens, and reject tokens that have expired. Also update test data - CVE-2013-2104 - LP: #1179615 * debian/patches/fix-testsuite-for-2038-problem.patch: Adjust json example cert data to use 2037 instead of 2112 and regenerate the certs. Also adjust token expiry data to use 2037 instead of 2999. * SECURITY UPDATE: fix authentication bypass when using LDAP backend - debian/patches/CVE-2013-2157.patch: identity/backends/ldap/core.py is adjusted to raise an assertion for invalid password when using LDAP and an empty password is submitted - CVE-2013-2157 - LP: #1187305	Jamie Strandboge	2012.2.4-0ubuntu3.1	10 years ago
41	debian/patches/update_certs.patch: Fix FTBFS. Original SSL ... debian/patches/update_certs.patch: Fix FTBFS. Original SSL certs for test suite expired May 18 2013. Cherry-picked regenerated certs from stable/folsom commit c14f2789.	James Page	2012.2.4-0ubuntu3	10 years ago
40	* SECURITY UPDATE: delete user token immediately upon delete... * SECURITY UPDATE: delete user token immediately upon delete when using v2 API - CVE-2013-2059.patch: adjust keystone/identity/core.py to call token_api.delete_token() during delete. Also update test suite. - CVE-2013-2059 - LP: #1166670	Jamie Strandboge	2012.2.3+stable-20130206-82c87e56-0ubuntu2.1	10 years ago
39	* Resync with latest security updates. * Resync with latest security updates. * SECURITY UPDATE: fix PKI revocation bypass - debian/patches/CVE-2013-1865.patch: validate tokens from the backend - CVE-2013-1865 * SECURITY UPDATE: fix EC2-style authentication for disabled users - debian/patches/CVE-2013-0282.patch: adjust keystone/contrib/ec2/core.py to ensure user and tenant are enabled in EC2 - CVE-2013-0282 * SECURITY UPDATE: fix denial of service - debian/patches/CVE-2013-1664+1665.patch: disable XML entity parsing - CVE-2013-1664 - CVE-2013-1665	James Page	2012.2.3+stable-20130206-82c87e56-0ubuntu2	11 years ago
38	* SECURITY UPDATE: fix PKI revocation bypass * SECURITY UPDATE: fix PKI revocation bypass - debian/patches/CVE-2013-1865.patch: validate tokens from the backend - CVE-2013-1865 - LP: #1129713	Jamie Strandboge	2012.2.1-0ubuntu1.3	11 years ago
37	* SECURITY UPDATE: fix EC2-style authentication for disabled... * SECURITY UPDATE: fix EC2-style authentication for disabled users - debian/patches/CVE-2013-0282.patch: adjust keystone/contrib/ec2/core.py to ensure user and tenant are enabled in EC2 - CVE-2013-0282 - LP: #1121494 * SECURITY UPDATE: fix denial of service - debian/patches/CVE-2013-1664+1665.patch: disable XML entity parsing - CVE-2013-1664 - CVE-2013-1665 - LP: #1100279 - LP: #1100282	Jamie Strandboge	2012.2.1-0ubuntu1.2	11 years ago
36	* SECURITY UPDATE: fix token creation error handling * SECURITY UPDATE: fix token creation error handling - debian/patches/CVE-2013-0247.patch: validate size of user_id, username, password, tenant_name, tenant_id and old_token size to help guard against a denial of service via large log files filling the disk - CVE-2013-0247	Jamie Strandboge	2012.2.1-0ubuntu1.1	11 years ago
35	* SECURITY UPDATE: fix for EC2-style credentials invalidatio... * SECURITY UPDATE: fix for EC2-style credentials invalidation - debian/patches/CVE-2012-5571.patch: adjust contrib/ec2/core.py to verify that the user is in at least one valid role for the tenant - CVE-2012-5571 - LP: #1064914 * debian/patches/fix-ssl-tests-lp1068851.patch: update certificates for SSL tests * SECURITY UPDATE: fix for token expiration - debian/patches/CVE-2012-5563.patch: ensure token expiration is maintained - CVE-2012-5563 - LP: #1079216	Jamie Strandboge	2012.2-0ubuntu1.2	11 years ago
34	New upstream release. New upstream release.	Chuck Short	2012.2-0ubuntu1	11 years ago
33	New upstream release. New upstream release.	Chuck Short	2012.2~rc2-0ubuntu1	11 years ago
32	* New upstream version. * New upstream version. * debian/keystone.logrotate: Compress log file when rotated. (LP: #1049309)	Chuck Short	2012.2~rc1-0ubuntu1	11 years ago
31	[ Adam Gandelman ] [ Adam Gandelman ] * Refreshed patches. [ Soren Hansen ] * Update debian/watch to account for symbolically named tarballs and use newer URL. * Fix Launchpad URLs in debian/watch. [ Logan Rosen ] * Fix control file to suggest python-memcache instead of python-memcached (LP: #998991). [ Chuck Short ] * New upstream version. * Dont FTBFS if the testsuite fails.	Chuck Short	2012.2~rc1~20120906.2517-0ubuntu2	11 years ago
30	[ Adam Gandelman ] [ Adam Gandelman ] * debian/{keystone.conf, rules, keytone.install}: Install patched keystone.conf.sample configured for SQL backends to /etc/keystone, no longer maintain our own version in packaging. (LP: #1031012) * debian/patches/sql_connection.patch: Refreshed against current keystone.conf.sample. * debian/rules: Use debian/tests as HOME to avoid test suite FTFBS. [ Sam Morrison ] * debian/keystone.logrotate: Sent output of keystone restart in logrotate to /dev/null. (LP: #1029766) [Chuck Short] * New upstream version.	Chuck Short	2012.2~f3-0ubuntu1	11 years ago
29	New upstream version. New upstream version.	Chuck Short	2012.2~f2-0ubuntu1	11 years ago
28	New upstream release. New upstream release.	Chuck Short	2012.2~f2~20120622.2353-0ubuntu1	11 years ago
27	* New usptream release. * New usptream release. * debian/patches/sql_connection.patch: Refreshed	Chuck Short	2012.2~f2~20120529.2315-0ubuntu1	11 years ago
26	* New ustpream release. * New ustpream release. * Prepare for quantal: - debian/patches/fix-ubuntu-tests.patch: Refreshed. - debian/patches/sql_connection.patch: Refreshed. * debian/keystone.install: Install the right configuration files.	Chuck Short	2012.2~f1-0ubuntu1	11 years ago
25	* New upstream version. * New upstream version. * debian/man/keystone.8: Mention that there is a lack of ssl support.	Chuck Short	2012.1-0ubuntu1	12 years ago
24	[Chuck Short] [Chuck Short] * New upstream version. * debian/keystone.install: install tools/{convert_to_sqlite.sh, sample_data.sh} [Adam Gandelman] * debian/patches/fix-ubuntu-tests.patch: Also skip keystoneclient essex 3 tests, add patch description * debian/keystone.logrotate: Add logrotate config (LP: #962426)	Chuck Short	2012.1~rc2-0ubuntu1	12 years ago

Older »