| Summary: | subversion new security issues CVE-2015-3184 and CVE-2015-3187 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | nicolas.salguero, sysadmin-bugs |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/654148/ | ||
| Whiteboard: | MGA4TOO has_procedure MGA4-64-OK MGA5-64-OK advisory | ||
| Source RPM: | subversion-1.8.13-1.mga5.src.rpm | CVE: | |
| Status comment: | |||
| Bug Depends on: | |||
| Bug Blocks: | 16075 | ||
|
Description
David Walser
2015-08-11 17:49:16 CEST
Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=14826#c2 Blocks:
(none) =>
16075
David Walser
2015-08-11 18:17:46 CEST
URL:
(none) =>
http://lwn.net/Vulnerabilities/654148/ (In reply to David Walser from comment #1) > Testing procedure: > https://bugs.mageia.org/show_bug.cgi?id=14826#c2 Note that in Mageia 4 we have to edit /etc/httpd/conf/conf.d/subversion.conf when following this procedure, not /etc/httpd/modules.d/something anymore. Testing complete using the above procedure. David, I see in subversion's spec file that there is a test suite, but it's not run at build time. Do you know why?
Samuel Verschelde
2015-08-18 11:15:57 CEST
Whiteboard:
MGA4TOO has_procedure =>
MGA4TOO has_procedure MGA4-64-OK (In reply to Samuel VERSCHELDE from comment #3) > Testing complete using the above procedure. David, I see in subversion's > spec file that there is a test suite, but it's not run at build time. Do you > know why? No. I can try running it on the BS in Cauldron and see if it passes. (In reply to David Walser from comment #4) > (In reply to Samuel VERSCHELDE from comment #3) > > Testing complete using the above procedure. David, I see in subversion's > > spec file that there is a test suite, but it's not run at build time. Do you > > know why? > > No. I can try running it on the BS in Cauldron and see if it passes. OK I just looked at this in the SPEC, and I think the comment right at the top answers your question as to why this isn't enabled: echo "This can take quite some time to finish, so please be patient..." echo "Don't be too surprised it the tests takes 30 minutes on a dual xeon machine..." Also, I don't know how long it's been since anyone tried to run it, so all that mess of setting up the LD_LIBRARY_PATH may not even still be correct, and if it's still needed, it doesn't appear that the make check is really designed to actually be used. Upstream should fix that for it to even be worth worrying about. Updated SVN on my Mageia 5 64bit and used it to upload the advisory. It's a bit light for a test and only covers subversion, lib64svn0 and perl-SVN, but since Stormi tested the full procedure on Mageia 4 already, I'll add an OK. Whiteboard:
MGA4TOO has_procedure MGA4-64-OK =>
MGA4TOO has_procedure MGA4-64-OK MGA5-64-OK advisory Hi, Regarding Bug 16075, I have tested the Mageia 5 update and, for me, all is ok now. Best regards, Nico. CC:
(none) =>
nicolas.salguero Validating. Keywords:
(none) =>
validated_update An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0326.html Status:
NEW =>
RESOLVED |