sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
Re: [SM-Discuss] We have a vulnerable glibc (2.13) in stable
- From: Vlad Glagolev <stealth AT tiberian.ru>
- To: sm-discuss <sm-discuss AT lists.ibiblio.org>
- Subject: Re: [SM-Discuss] We have a vulnerable glibc (2.13) in stable
- Date: Thu, 29 Jan 2015 10:33:28 +0300
I hope we'll roll out 0.61-21 stable, once our infrastructure is
recovered.
But for now you can get an updated glibc spell which will go into
stable from my personal grimoire. It can be accessed via rsync:
scribe add prototype from rsync://rsync.stealth.zone::codex/prototype/
you only need glibc spell from there, but besides it the grimoire
contains several spells from test.
glibc spell has a rearranged official patch for 2.13 and 2.3.6 versions
of glibc we have in current stable (0.61-20). I've tested it on 3 boxes
-- no problems so far, and will continue upgrading on others (around 85
machines) today. I'll report back if I find any issues related to the
security upgrade process.
On Wed, 28 Jan 2015 09:08:38 -0600
David Kowis <dkowis AT shlrm.org> wrote:
> As of 28 Jan 2015:
> http://dbg.download.sourcemage.org/grimoire/codex/stable/libs/glibc/DETAILS
>
>
> https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability
>
> If I'm parsing that DETAILS file correctly (which by the way, it's super
> nasty), it's possible to get a glibc version of 2.13, which is super
> vulnerable to all sorts of things.
>
> My upgrade history with glibc has not been very good, as in when I
> update glibc, somehow I manage to hork the entire system and have to
> reinstall, so I'd appreciate it if someone else worked on it, heh.
>
> Also, it should be known that you can get a vulnerable glibc in stable
> sourcemage. So this is making it known
>
--
Vlad Glagolev <stealth AT tiberian.ru>
Attachment:
pgpwsWXMCIVBC.pgp
Description: PGP signature
-
[SM-Discuss] We have a vulnerable glibc (2.13) in stable,
David Kowis, 01/28/2015
- Re: [SM-Discuss] We have a vulnerable glibc (2.13) in stable, Vlad Glagolev, 01/29/2015
Archive powered by MHonArc 2.6.24.