mirror of
https://github.com/flatcar/scripts.git
synced 2025-08-17 18:06:59 +02:00
Merge pull request #721 from dm0-/glsa
bump(metadata/glsa): sync with upstream
This commit is contained in:
David Michael
GitHub
commit
a2a75ce2d5
@ -1,23 +1,23 @@
|
||||
-----BEGIN PGP SIGNED MESSAGE-----
|
||||
Hash: SHA512
|
||||
|
||||
MANIFEST Manifest.files.gz 440123 BLAKE2B 47652947d6c26c7bbac6a5c0bd24fb3c439032faa43da521eacb80cffe306ba49152b4848845d3bd677e90481d8a7f19855a790d203085d2cb6d866eca1771b5 SHA512 51daf36dd12ed79db6c4817f04ce4f65259ca3bdd0a5bba3ce51df64b42b9630e4a8a51c1c35db67c1d1be1b6a33e8ba1a2a4597de4a7ffe2b7186f3fd88503a
|
||||
TIMESTAMP 2019-04-02T14:38:49Z
|
||||
MANIFEST Manifest.files.gz 440912 BLAKE2B 9ea8574697c29c79c477a36363f4d2c7b47da71f24d32c0c849b43ce85c6195cd38852f18e3e9f5a67f08e2d69d3d9091663b6da7e2de6a6da8181d5e49cc23c SHA512 9cb4038f89f175ad7d3ff9ca55bdb899358687b385a53ef46218971a23729281d566301e32309e2541593a1f08bdac5dd3cd4b48d7044ca634475e0fe0bfcaea
|
||||
TIMESTAMP 2019-04-11T12:38:47Z
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlyjc/lfFIAAAAAALgAo
|
||||
iQKTBAEBCgB9FiEE4dartjv8+0ugL98c7FkO6skYklAFAlyvNVdfFIAAAAAALgAo
|
||||
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEUx
|
||||
RDZBQkI2M0JGQ0ZCNEJBMDJGREYxQ0VDNTkwRUVBQzkxODkyNTAACgkQ7FkO6skY
|
||||
klCw7g/9HNNxIMGlCPXL3nWsUvd5f2mbf97RrRtVB8c45y2+92Him54LDRe7Q85d
|
||||
yWQiYAxjwHyjkAMRAC5iaR6bF9+IG79Su+ncR+AzRNPJu++Y9AHGiMXynqQis5uy
|
||||
b6FJuiOhc+VsfMIyNvJZT44NVF9dIKnGtL/SpPIbHDzrvqP9qsDtzpNfHTa5IsNC
|
||||
7Br8ho0ReC8cM9kEATsqg7kCkLx5WokuIlYwsuoQA6xEnkHTcDMZxpNZazgskhlk
|
||||
SLhr8XpOoau/SvJQz7Xcx4KN1DGg9tEN0CSJ0olpHbsclo/ej3tZMXNtiLnXJf6y
|
||||
Hti7G3pGDl0xylA8agE0QzDhB++G32DRpZwk7TB2JYBeElPsM7mzAN0L/DI+KYKi
|
||||
Nz35MYvNjZbchs84VZGaWM+3UoebdX1ZQcVhIsK6HTQ77AVuOs4B9zJtOiCGeh8j
|
||||
iyNFD9CVooFfg3IzwRz7DHzu/n/mWbpNKPOTT00j/jMEgew5Kq9TsKXZNB3lqFYe
|
||||
mdSiL6s3eZI24RwZgDXwvUeqOkzb4r/GptdGnpXDwNaPASV8YhpRqtX+L08LJW4Q
|
||||
AfVvtxELrzXqqvoH/cr8soDDGHLaq8I4ZaDli4/Xqfr4ikHdgHHFkrn5SZhLMham
|
||||
vrwFYgk5tiGDJ6JBdgL9TPbGgQrL69Iyw2AYwM4ThhcZiwD1nZE=
|
||||
=ydvg
|
||||
klA7VBAAmDdXoj2eZ1SsUTbehYwJzWTAauBYVV5tm9KK9h1rLUgeYBQLhnV9f5HQ
|
||||
cSwhXkE2ldTSCGaCPHEKUQ8MoB4gt20/Rfx1DAyUwfx7gwCvzcyQgdb6nMDPcCsf
|
||||
5GcNn4533pkSM1xMAZuphqgHNb5Q8uFtKWwfqxiW7qt1a+h1f0MmTO0dKAEv3QUh
|
||||
RXLe8Z9o5fUpN+NJDabm3ChqDThGmf2RLCj9X8xbvSiSRli/++N7IcOMxtOzpcJM
|
||||
CIr6FqUXA9aEOvq0lae3T6L7lCjQwbbE6TB4A/iDkRYZZnp37q4KzOQyL6c+88JA
|
||||
fqzvpBLA4FzQiglosTffBo9Qj1iO5Yet/5Hu1OzaNUytMbpyUKfunoOwO4xcb89X
|
||||
O3CiwJgQ/QVgqCrZdpcN/FSt2MH8FENsdi3g+ukJGFsdZZdJANozGXrIGxVNKQ99
|
||||
4L7PdRkuxz/DWUAoZxr4HRHImtlpeiqXIaydNw5gdwfK48WoPSmDr84LcQRrHsTv
|
||||
f5S2jtvLp3TlLe0GNRfKxEZDyaNHFk4AtZYpixd8e4Fj7b4HQJMEZ517Hw8flVj6
|
||||
zcs5jHWj8fYWEUjMBmALuLdMxx/jbf12V/XEjJRitIWQje/smWl0LLhbtPNb6a9B
|
||||
C2MKIRNe4w0gUbe+rOUVWQXKG+ke7wToYWIJJ6AV8Iz7Kb85n3I=
|
||||
=K0i0
|
||||
-----END PGP SIGNATURE-----
|
||||
|
||||
Binary file not shown.
70
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-09.xml
vendored
Normal file
70
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-09.xml
vendored
Normal file
@ -0,0 +1,70 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201904-09">
|
||||
<title>Xen: Multiple Vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in Xen, the worst of which
|
||||
could result in privilege escalation.
|
||||
</synopsis>
|
||||
<product type="ebuild">xen</product>
|
||||
<announced>2019-04-04</announced>
|
||||
<revised count="2">2019-04-04</revised>
|
||||
<bug>679580</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="app-emulation/xen" auto="yes" arch="*">
|
||||
<unaffected range="ge">4.10.3-r1</unaffected>
|
||||
<vulnerable range="lt">4.10.3-r1</vulnerable>
|
||||
</package>
|
||||
<package name="app-emulation/xen-pvgrub" auto="yes" arch="*">
|
||||
<unaffected range="ge">4.10.3</unaffected>
|
||||
<vulnerable range="lt">4.10.3</vulnerable>
|
||||
</package>
|
||||
<package name="app-emulation/xen-tools" auto="yes" arch="*">
|
||||
<unaffected range="ge">4.10.3-r2</unaffected>
|
||||
<vulnerable range="lt">4.10.3-r2</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Xen is a bare-metal hypervisor.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in Xen. Please review the
|
||||
referenced XSA security advisories.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>Please review the referenced XSA security advisories for details.</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Xen users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=app-emulation/xen-4.10.3-r2"
|
||||
</code>
|
||||
|
||||
<p>All Xen pvgrub users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose
|
||||
">=app-emulation/xen-pvgrub-4.10.3-r2"
|
||||
</code>
|
||||
|
||||
<p>All Xen tools users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose
|
||||
">=app-emulation/xen-tools-4.10.3-r2"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="http://xenbits.xen.org/xsa/">XSA Security Advisory</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-03-28T03:48:31Z">BlueKnight</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-04-04T18:34:06Z">b-man</metadata>
|
||||
</glsa>
|
||||
49
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-10.xml
vendored
Normal file
49
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-10.xml
vendored
Normal file
@ -0,0 +1,49 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201904-10">
|
||||
<title>Mailman: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in Mailman, the worst of
|
||||
which could result in the arbitrary execution of code.
|
||||
</synopsis>
|
||||
<product type="ebuild">mailman</product>
|
||||
<announced>2019-04-08</announced>
|
||||
<revised count="1">2019-04-08</revised>
|
||||
<bug>662902</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="net-mail/mailman" auto="yes" arch="*">
|
||||
<unaffected range="ge">2.1.29</unaffected>
|
||||
<vulnerable range="lt">2.1.29</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Mailman is a Python based mailing list server with an extensive web
|
||||
interface.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in Mailman. Please review
|
||||
the referenced CVE identifier for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>Please review the referenced CVE identifiers for details.</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Mailman users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=net-mail/mailman-2.1.29"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-0618">CVE-2018-0618</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-13796">CVE-2018-13796</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-03-28T03:31:17Z">BlueKnight</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-04-08T15:19:06Z">b-man</metadata>
|
||||
</glsa>
|
||||
59
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-11.xml
vendored
Normal file
59
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-11.xml
vendored
Normal file
@ -0,0 +1,59 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201904-11">
|
||||
<title>Portage: Man-in-the-middle</title>
|
||||
<synopsis>A vulnerability in emerge-delta-webrsync and Portage could result
|
||||
in a man-in-the-middle attack.
|
||||
</synopsis>
|
||||
<product type="ebuild">portage</product>
|
||||
<announced>2019-04-08</announced>
|
||||
<revised count="1">2019-04-08</revised>
|
||||
<bug>646212</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="app-portage/emerge-delta-webrsync" auto="yes" arch="*">
|
||||
<unaffected range="ge">3.7.4</unaffected>
|
||||
<vulnerable range="lt">3.7.4</vulnerable>
|
||||
</package>
|
||||
<package name="sys-apps/portage" auto="yes" arch="*">
|
||||
<unaffected range="ge">2.3.22</unaffected>
|
||||
<vulnerable range="lt">2.3.22</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Portage is the package management and distribution system for Gentoo.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>A vulnerability was discovered in emerge-delta-webrsync and Portage that
|
||||
did not properly validate the revocation status of GPG keys.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>A remote attacker could conduct a man-in-the-middle attack. Please
|
||||
review the referenced bug for specific details.
|
||||
</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All emerge-delta-webrsync users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose
|
||||
">=app-portage/emerge-delta-webrsync-3.7.4"
|
||||
</code>
|
||||
|
||||
<p>All Portage users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=sys-apps/portage-2.3.22"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-03-24T23:20:15Z">BlueKnight</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-04-08T15:21:14Z">b-man</metadata>
|
||||
</glsa>
|
||||
56
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-12.xml
vendored
Normal file
56
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-12.xml
vendored
Normal file
@ -0,0 +1,56 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201904-12">
|
||||
<title>ClamAV: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in ClamAV, the worst of
|
||||
which could result in a Denial of Service condition.
|
||||
</synopsis>
|
||||
<product type="ebuild">clamav</product>
|
||||
<announced>2019-04-08</announced>
|
||||
<revised count="1">2019-04-08</revised>
|
||||
<bug>660820</bug>
|
||||
<bug>667900</bug>
|
||||
<bug>681840</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="app-antivirus/clamav" auto="yes" arch="*">
|
||||
<unaffected range="ge">0.101.2</unaffected>
|
||||
<vulnerable range="lt">0.101.2</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>ClamAV is a GPL virus scanner.</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in ClamAV. Please review
|
||||
the CVE identifiers referenced below for details.
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>Please review the referenced CVE identifiers for details.</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All ClamAV users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.101.2"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-0360">CVE-2018-0360</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-0361">CVE-2018-0361</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-15378">CVE-2018-15378</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-1785">CVE-2019-1785</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-1786">CVE-2019-1786</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-1787">CVE-2019-1787</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-1788">CVE-2019-1788</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-1789">CVE-2019-1789</uri>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2019-1798">CVE-2019-1798</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-03-29T21:05:49Z">b-man</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-04-08T15:22:53Z">b-man</metadata>
|
||||
</glsa>
|
||||
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-13.xml
vendored
Normal file
50
sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-201904-13.xml
vendored
Normal file
@ -0,0 +1,50 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
||||
<glsa id="201904-13">
|
||||
<title>Git: Multiple vulnerabilities</title>
|
||||
<synopsis>Multiple vulnerabilities have been found in Git, the worst of which
|
||||
could result in the arbitrary execution of code.
|
||||
</synopsis>
|
||||
<product type="ebuild">git</product>
|
||||
<announced>2019-04-11</announced>
|
||||
<revised count="1">2019-04-11</revised>
|
||||
<bug>671988</bug>
|
||||
<bug>676262</bug>
|
||||
<access>remote</access>
|
||||
<affected>
|
||||
<package name="dev-vcs/git" auto="yes" arch="*">
|
||||
<unaffected range="ge">2.20.1</unaffected>
|
||||
<vulnerable range="lt">2.20.1</vulnerable>
|
||||
</package>
|
||||
</affected>
|
||||
<background>
|
||||
<p>Git is a free and open source distributed version control system
|
||||
designed to handle everything from small to very large projects with
|
||||
speed and efficiency.
|
||||
</p>
|
||||
</background>
|
||||
<description>
|
||||
<p>Multiple vulnerabilities have been discovered in Git. Please review the
|
||||
referenced CVE identifiers for details
|
||||
</p>
|
||||
</description>
|
||||
<impact type="normal">
|
||||
<p>Please review the referenced CVE identifier and bugs for details.</p>
|
||||
</impact>
|
||||
<workaround>
|
||||
<p>There is no known workaround at this time.</p>
|
||||
</workaround>
|
||||
<resolution>
|
||||
<p>All Git users should upgrade to the latest version:</p>
|
||||
|
||||
<code>
|
||||
# emerge --sync
|
||||
# emerge --ask --oneshot --verbose ">=dev-vcs/git-2.19.2"
|
||||
</code>
|
||||
</resolution>
|
||||
<references>
|
||||
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2018-19486">CVE-2018-19486</uri>
|
||||
</references>
|
||||
<metadata tag="requester" timestamp="2019-03-10T06:15:06Z">BlueKnight</metadata>
|
||||
<metadata tag="submitter" timestamp="2019-04-11T01:14:55Z">b-man</metadata>
|
||||
</glsa>
|
||||
@ -1 +1 @@
|
||||
Tue, 02 Apr 2019 14:38:45 +0000
|
||||
Thu, 11 Apr 2019 12:38:43 +0000
|
||||
|
||||
@ -1 +1 @@
|
||||
30de0bf9ee6986a07eef489491b435e55fc9cafe 1554179778 2019-04-02T04:36:18+00:00
|
||||
f968e3b69dbac09ac866bb6aa6abb70acbd31a8b 1554945337 2019-04-11T01:15:37+00:00
|
||||
|
||||
Loading…
Reference in New Issue
Block a user