Branches for Oneiric

Author: Jamie Strandboge
Revision Date: 2011-09-30 08:29:40 UTC

* SECURITY UPDATE: k5login can overwrite arbitrary files as root
  - debian/patches/CVE-2011-3869.patch: adjust type/k5login.rb to securely
    open the file before writing to it as root
  - CVE-2011-3869
* SECURITY UPDATE: didn't drop privileges before creating and changing
  permissions on SSH keys
  - debian/patches/CVE-2011-3870.patch: adjust ssh_authorized_key/parsed.rb
    to drop privileges before creating the ssh directory and setting
    permissions
  - CVE-2011-3870
* SECURITY UPDATE: fix predictable temporary filename in ralsh
  - debian/patches/CVE-2011-3871.patch: adjust application/resource.rb to
    use an unpredictable filename
  - CVE-2011-3871
* SECURITY UPDATE: file indirector injection, similar to CVE-2011-3848
  - secure-indirector-file-backed-terminus-base-cla.patch: Since the
    indirector file backed terminus base class is only used by the test
    suite, remove it and update test cases to use a continuing class.

Author: Marc Deslauriers
Revision Date: 2013-03-11 12:49:11 UTC

* SECURITY UPDATE: Multiple security issues
  - debian/patches/security-mar-2013.patch: upstream patch to fix
    multiple security issues.
  - CVE-2013-1640 - Remote code execution on master from authenticated clients
  - CVE-2013-1652 - Insufficient input validation
  - CVE-2013-1653 - Remote code execution
  - CVE-2013-1654 - Protocol downgrade
  - CVE-2013-1655 - Unauthenticated remote code execution risk
  - CVE-2013-2275 - Incorrect default report ACL

Author: Marc Deslauriers
Revision Date: 2013-03-11 12:49:11 UTC

* SECURITY UPDATE: Multiple security issues
  - debian/patches/security-mar-2013.patch: upstream patch to fix
    multiple security issues.
  - CVE-2013-1640 - Remote code execution on master from authenticated clients
  - CVE-2013-1652 - Insufficient input validation
  - CVE-2013-1653 - Remote code execution
  - CVE-2013-1654 - Protocol downgrade
  - CVE-2013-1655 - Unauthenticated remote code execution risk
  - CVE-2013-2275 - Incorrect default report ACL

Author: Marc Cluet
Revision Date: 2011-09-20 20:48:11 UTC

* Modified changelog to reflect Ubuntu diffs from debian upstream release

Author: Andreas Moog
Revision Date: 2011-03-01 17:32:11 UTC

* debian/puppetmaster.default
  - fix remains of automated merge (LP: #726856)

Author: Colin Watson
Revision Date: 2011-05-04 12:01:11 UTC

merge lp:~ubuntu-branches/ubuntu/oneiric/puppet/oneiric-201105031912 (history only)