Fedora alert FEDORA-2014-13764 (Pound)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 19 Update: Pound-2.6-8.fc19 | |
| Date: | Fri, 07 Nov 2014 02:38:03 +0000 | |
| Message-ID: | <20141107023803.4329260E587A@bastion01.phx2.fedoraproject.org> |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2014-13764 2014-10-28 05:16:41 -------------------------------------------------------------------------------- Name : Pound Product : Fedora 19 Version : 2.6 Release : 8.fc19 URL : http://www.apsis.ch/pound Summary : Reverse proxy and load balancer Description : The Pound program is a reverse proxy, load balancer and HTTPS front-end for Web server(s). Pound was developed to enable distributing the load among several Web-servers and to allow for a convenient SSL wrapper for those Web servers that do not offer it natively. Pound is distributed under the GPL - no warranty, it's free to use, copy and give away -------------------------------------------------------------------------------- Update Information: Backport various security fixes. Note they usually are extra options that need to be enabled manually so that we won't break functionality: - CVE-2011-3389: Make it possible to deny use of "BEAST" vulnerable ciphers - CVE-2012-4929: Disable compression to be safe from "CRIME" - CVE-2005-2090: Chunked encofing response splitting (no awkward name here) - CVE-2014-3566: Allow disabling SSLv3 (and others), to be safe from "POODLE" - A redirect XSS fix -------------------------------------------------------------------------------- ChangeLog: * Fri Oct 24 2014 Lubomir Rintel <lkundrak@v3.sk> - 2.6-8 - Backport various security fixes. Note they usually are extra options that need to be enabled manually so that we won't break functionality: - CVE-2011-3389: Make it possible to deny use of "BEAST" vulnerable ciphers - CVE-2012-4929: Disable compression to be safe from "CRIME" - CVE-2005-2090: Chunked encofing response splitting (no awkward name here) - CVE-2014-3566: Allow disabling SSLv3 (and others), to be safe from "POODLE" - A redirect XSS fix * Fri Aug 2 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.6-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update Pound' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...