Pronađen je i otklonjen sigurnosni propust paketa keepalived koji je lokalnom zlonamjernom korisniku omogućavao gašenje pojedinih procesa.

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-12367
2012-08-21 09:29:28
--------------------------------------------------------------------------------

Name        : keepalived
Product     : Fedora 16
Version     : 1.2.3
Release     : 2.fc16
URL         : http://www.keepalived.org/
Summary     : High Availability monitor built upon LVS, VRRP and service pollers
Description :
The main goal of the keepalived project is to add a strong & robust keepalive
facility to the Linux Virtual Server project. This project is written in C with
multilayer TCP/IP stack checks. Keepalived implements a framework based on
three family checks : Layer3, Layer4 & Layer5/7. This framework gives the
daemon the ability to check the state of an LVS server pool. When one of the
servers of the LVS server pool is down, keepalived informs the linux kernel via
a setsockopt call to remove this server entry from the LVS topology. In
addition keepalived implements an independent VRRPv2 stack to handle director
failover. So in short keepalived is a userspace daemon for LVS cluster nodes
healthchecks and LVS directors failover.

--------------------------------------------------------------------------------
Update Information:

Update to keepalived v1.2.3 stable release.
--------------------------------------------------------------------------------
ChangeLog:

* Mon Aug 20 2012 Ryan O'Hara <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.2.3-2
- Remove unused patches.
* Mon Aug 20 2012 Ryan O'Hara <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.2.3-1
- Update to 1.2.3.
- Fix permissions on pid file (#704040).
* Tue Mar 20 2012 Ryan O'Hara <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.2.2-4
- Fix IPv4 address comparison (#768119).
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #704039 - CVE-2011-1784 keepalived: insecure permissions on pid
files
        https://bugzilla.redhat.com/show_bug.cgi?id=704039
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update keepalived' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-12377
2012-08-21 09:30:09
--------------------------------------------------------------------------------

Name        : keepalived
Product     : Fedora 17
Version     : 1.2.5
Release     : 2.fc17
URL         : http://www.keepalived.org/
Summary     : High Availability monitor built upon LVS, VRRP and service pollers
Description :
The main goal of the keepalived project is to add a strong & robust keepalive
facility to the Linux Virtual Server project. This project is written in C with
multilayer TCP/IP stack checks. Keepalived implements a framework based on
three family checks : Layer3, Layer4 & Layer5/7. This framework gives the
daemon the ability to check the state of an LVS server pool. When one of the
servers of the LVS server pool is down, keepalived informs the linux kernel via
a setsockopt call to remove this server entry from the LVS topology. In
addition keepalived implements an independent VRRPv2 stack to handle director
failover. So in short keepalived is a userspace daemon for LVS cluster nodes
healthchecks and LVS directors failover.

--------------------------------------------------------------------------------
Update Information:

Update to keepalived v1.2.5 stable release.
--------------------------------------------------------------------------------
ChangeLog:

* Tue Aug 14 2012 Ryan O'Hara <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.2.5-2
- Fix path to mibs.
* Tue Aug 14 2012 Ryan O'Hara <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.2.5-1
- Update to 1.2.5.
* Wed Aug  1 2012 Ryan O'Hara <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.2.4-1
- Update to 1.2.4.
* Mon Jul 23 2012 Ryan O'Hara <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.2.3-1
- Update to 1.2.3.
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #704039 - CVE-2011-1784 keepalived: insecure permissions on pid
files
        https://bugzilla.redhat.com/show_bug.cgi?id=704039
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update keepalived' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce