[SECURITY] Fedora 9 Update: cman-2.03.09-1.fc9

updates at fedoraproject.org updates at fedoraproject.org
Fri Nov 7 02:55:52 UTC 2008

Fedora Update Notification
2008-11-07 01:35:31

Name        : cman
Product     : Fedora 9
Version     : 2.03.09
Release     : 1.fc9
URL         : http://sources.redhat.com/cluster/wiki/
Summary     : CMAN - The Cluster Manager
Description :
CMAN - The Cluster Manager

Update Information:

A major code audit did show several unsecure use of /tmp.    This update
addresses those issues across the whole code.

* Fri Oct 31 2008 Fabio M. Di Nitto <fdinitto at redhat.com> - 2.03.09-1
- New upstream release
  Fix rhbz#468966
  Addresses several security issues similar to CVE-2008-4192 and
  CVE-2008-4579 after deep code audit from upstream
- cleanup patches to match 2.6.26 kernel in F-9
* Tue Oct 21 2008 Fabio M. Di Nitto <fdinitto at redhat.com> - 2.03.08-1
- New upstream release
  Fix rhbz#460376 CVE-2008-4192
  Fix rhbz#467386 CVE-2008-4579
- cleanup/update patches to match 2.6.26 kernel in F-9
- add /var/log/cluster to the package
* Tue Sep 23 2008 Fabio M. Di Nitto <fdinitto at redhat.com> - 2.03.07-2
- Fix cman init script. BZ #461004
* Thu Aug 14 2008 Fabio M. Di Nitto <fdinitto at redhat.com> - 2.03.07-1
- New upstream release
- Fix rgmanager startup locking issues
- Apply patch to include kernel headers from 2.6.26 required to build
  userland. Userland will run in 2.6.25 compatibility mode
- Apply patch to keep kernel modules at 2.6.25 (upstream is at 2.6.26)
  (this patch is purely cosmetic since we don't build kernel modules
  but keep the source in sync is Good (tm))
- Cleanup packaging for installed docs and file permissions
* Mon Jul 14 2008 Fabio M. Di Nitto <fdinitto at redhat.com> - 2.03.05-1
- New upstream release
- Cleanup installed doc after upstream
- cman Requires: pyOpenSSL for new lpar fence agent
- cman Requires: pexpect and net-snmp-utils for fence agents
  Thanks to sendro on IRC for spotting the issue
* Tue Jun 10 2008 Fabio M. Di Nitto <fdinitto at redhat.com> - 2.03.04-1
- New upstream release
- Resolves: #446995 #318271 #447378 #445662
- Update license tags after major upstream cleanup
- Include COPYRIGHT file
- Add documentation
- Update Requires. Fence agents need ssh and telnet.
* Fri May 23 2008 Fabio M. Di Nitto <fdinitto at redhat.com> - 2.03.03-1
- New upstream release
- Resolves: rhbz#440770 rhbz#436240 rhbz#434905
- Add missing OpenIPMI requires to cman for fence_ipmilan
- Add missing sg3-utils requires to cman for fence_scsi
- Cleanup spec file and with it all rpmlint warnings/errors
- Drop all local patches. They have been included upstream

  [ 1 ] Bug #468966 - Possible buffer overflow in cman config loader can lead to memory corruption

This update can be installed with the "yum" update program.  Use 
su -c 'yum update cman' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at

More information about the Fedora-package-announce mailing list