lp:~racb/ubuntu/oneiric/cobbler/858878_security

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #858878: lack of csrf protection in cobbler-web

High

Invalid

Link a bug report

Related blueprints

58. By Robie Basak on 2012-01-05

debian/cobbler-common.install: do not install /etc/cobbler/users.digest.
This is created with the correct permissions by cobbler.postinst. Based
on fix to precise.

57. By Robie Basak on 2012-01-04

debian/cobbler.preinst: set /etc/cobbler/users.digest to 600 if upgrading
from a vulnerable version. Based on fix in precise.

56. By Robie Basak on 2012-01-04

Adjust changelog entries to match process template

55. By Robie Basak on 2011-12-08

* SECURITY UPDATE: webui_sessions uses insecure permissions (LP: #863755)
  - debian/cobbler.postinst: fix permissions on webui_{sessions,cache} to
    0700

54. By Robie Basak on 2011-12-08

* SECURITY UPDATE: users.digest file is world readable (LP: #858860)
  - debian/cobbler.postinst: create /etc/cobbler/users.digest as 600

53. By Robie Basak on 2011-12-08

* SECURITY UPDATE: arbitrary code execution via web interface (LP: #858883)
  - debian/patches/60_yaml_safe_load.patch: use yaml.safe_load instead of
    yaml.load (taken from upstream).

52. By Robie Basak on 2011-12-08

* SECURITY UPDATE: CSRF vulnerability in cobbler-web (LP: #858878)
  - debian/patches/59_add_csrf_protection.patch: use Django's built-in
    CSRF protection (taken from upstream).

51. By Robie Basak on 2011-12-08

* SECURITY UPDATE: arbitrary code execution via PYTHON_EGG_CACHE in
  insecure location (LP: #858875)
  - debian/patches/58_fix_egg_cache.patch: move PYTHON_EGG_CACHE to
    /var/lib/cobbler/webui_cache (copied from fix to precise).

50. By Andres Rodriguez on 2011-12-02

* SRU (LP: #899283):
  - debian/patches/47_ubuntu_add_oneiric_codename.patch: Updated to add
    'precise' as a importable/supported release.

49. By Luke Yelavich on 2011-09-29

releasing version 2.1.0+git20110602-0ubuntu26