Fedora alert FEDORA-2010-16902 (monotone)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 13 Update: monotone-0.48.1-1.fc13 | |
| Date: | Sat, 06 Nov 2010 23:41:37 +0000 | |
| Message-ID: | <20101106234137.23E5010F908@bastion02.phx2.fedoraproject.org> | |
| Archive‑link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2010-16902 2010-10-28 21:20:48 -------------------------------------------------------------------------------- Name : monotone Product : Fedora 13 Version : 0.48.1 Release : 1.fc13 URL : http://monotone.ca/ Summary : A free, distributed version control system Description : monotone is a free, distributed version control system. It provides fully disconnected operation, manages complete tree versions, keeps its state in a local transactional database, supports overlapping branches and extensible metadata, exchanges work over plain network protocols, performs history-sensitive merging, and delegates trust functions to client-side RSA certificates. -------------------------------------------------------------------------------- Update Information: Update to monotone-0.48.1, which contains a fix for a DoS: Running "mtn ''" or "mtn ls ''" doesn't cause an internal error anymore. In monotone 0.48 and earlier this behavior could be used to crash a server remotely (but only if it was configured to allow execution of remote commands). Therefore everyone running such a server should update as soon as possible. There's also a fix for a non-critical issue: Using mtn:// style URIs for netsync operations didn't work with 0.48 on systems which only have a 'monotone' entry in /etc/services. Failing to find a corresponding entry for the schema in a given URI isn't considered fatal now, instead mtn falls back to its default port. -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 27 2010 Thomas Moschny <thomas.moschny@gmx.de> - 0.48.1-1 - Update to 0.48.1. - Add patch from upstream to support newer sqlite. * Mon Jun 14 2010 Thomas Moschny <thomas.moschny@gmx.de> - 0.48-1 - Update to 0.48. * Sat May 8 2010 Thomas Moschny <thomas.moschny@gmx.de> - 0.47-3 - Add patch from upstream for a bug that prevents successful execution of push / pull / sync over pipes. * Thu Apr 29 2010 Marcela Maslanova <mmaslano@redhat.com> - 0.47-2 - Mass rebuild with perl-5.12.0 * Sun Apr 11 2010 Thomas Moschny <thomas.moschny@gmx.de> - 0.47-1 - Update to 0.47. - Remove patch applied upstream. -------------------------------------------------------------------------------- References: [ 1 ] Bug #647302 - CVE-2010-4098 monotone: remote DoS via empty arg to mtn command https://bugzilla.redhat.com/show_bug.cgi?id=647302 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update monotone' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...