lp:ubuntu/raring-security/puppet

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Related blueprints

71. By Marc Deslauriers on 2014-01-09

* SECURITY REGRESSION: Incorrect default file mode (LP: #1267385)
  - debian/patches/CVE-2013-4969-regression.patch: fix incorrect file
    mode in lib/puppet/type/file.rb, lib/puppet/util.rb,
    spec/unit/type/file_spec.rb.
  - CVE-2013-4969

70. By Marc Deslauriers on 2013-12-23

* SECURITY UPDATE: unsafe use of temp files
  - debian/patches/update-replace_file.patch: updated replace_file to
    enable Windows support so security patch applies better.
  - debian/patches/CVE-2013-4969-2.7.x-temp-file.patch: Use replace_file
    to update a file's contents in lib/puppet/type/file.rb,
    lib/puppet/util.rb, updated tests in
    spec/integration/type/file_spec.rb, spec/unit/type/file_spec.rb.
  - CVE-2013-4969

69. By Marc Deslauriers on 2013-08-14

* SECURITY UPDATE: August 2013 privilege escalation and code execution
  vulnerabilities
  - debian/patches/2.7.22-puppet-Aug-2013-CVE-fixes.patch: backport of
    upstream patch to resolve security issues.
  - CVE-2013-4956
  - CVE-2013-4761

68. By Marc Deslauriers on 2013-06-14

* SECURITY UPDATE: Remote code execution on master from unauthenticated
  clients
  - debian/patches/2.7.21-Patch-for-CVE-2013-3567.patch: backport of
    upstream patch to use safe_yama.
  - CVE-2013-3567

67. By Robie Basak on 2013-04-08

* Merge from Debian unstable. This merges the vim addon fix in 2.7.18-2
  (LP: #1163927). Remaining changes:
  - debian/puppetmaster-passenger.postinst: Make sure we error if puppet
    config print doesn't work
  - debian/puppetmaster-passenger.postinst: Ensure upgrades from
    <= 2.7.11-1 fixup passenger apache configuration.
  - Drop Build-Depends on ruby-rspec (in universe):
    + debian/control: remove ruby-rspec from Build-Depends
    + debian/patches/no-rspec.patch: make Rakefile work anyway if rspec
      isn't installed so we can use it in debian/rules.
* Drop upstreamed patches:
  - debian/patches/security-mar-2013.patch

66. By Marc Deslauriers on 2013-03-11

* SECURITY UPDATE: Multiple security issues
  - debian/patches/security-mar-2013.patch: upstream patch to fix
    multiple security issues.
  - CVE-2013-1640 - Remote code execution on master from authenticated clients
  - CVE-2013-1652 - Insufficient input validation
  - CVE-2013-1653 - Remote code execution
  - CVE-2013-1654 - Protocol downgrade
  - CVE-2013-1655 - Unauthenticated remote code execution risk
  - CVE-2013-2275 - Incorrect default report ACL

65. By Marc Deslauriers on 2012-07-14

* Resynchronise with Debian. (LP: #1023931) Remaining changes:
  - debian/puppetmaster-passenger.postinst: Make sure we error if puppet
    config print doesn't work
  - debian/puppetmaster-passenger.postinst: Ensure upgrades from
    <= 2.7.11-1 fixup passenger apache configuration.
* Dropped upstreamed patches:
  - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch
  - debian/patches/puppet-12844
  - debian/patches/2.7.17-Puppet-July-2012-CVE-fixes.patch
* Drop Build-Depends on ruby-rspec (in universe):
  - debian/control: remove ruby-rspec from Build-Depends
  - debian/patches/no-rspec.patch: make Rakefile work anyway if rspec
    isn't installed so we can use it in debian/rules.

64. By Marc Deslauriers on 2012-07-13

* SECURITY UPDATE: Multiple July 2012 security issues
  - debian/patches/2.7.17-Puppet-July-2012-CVE-fixes.patch: upstream
    patch to fix multiple security issues.
  - CVE-2012-3864: arbitrary file read on master from authenticated
    clients
  - CVE-2012-3865: arbitrary file delete or denial of service on master
    from authenticated clients
  - CVE-2012-3866: last_run_report.yaml report file is world readable and
    leads to arbitrary file read on master by an agent
  - CVE-2012-3867: insufficient input validation for agent cert hostnames
* debian/control: use ruby1.8 as Build-Depends-Indep to fix FTBFS

63. By Tyler Hicks on 2012-04-11

* SECURITY UPDATE: Arbitrary file writes via predictable filename usage in
  appdmg and pkgdmg providers (LP: #978708)
  - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch
  - CVE-2012-1906
* SECURITY UPDATE: Arbitrary file reads via Filebucket REST requests
  - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch
  - CVE-2012-1986
* SECURITY UPDATE: Denial of service via Filebucket text/marshall support
  - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch
  - CVE-2012-1987
* SECURITY UPDATE: Arbitrary code execution via Filebucket requests
  - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch
  - CVE-2012-1988
* SECURITY UPDATE: Arbritrary file writes via predictable telnet output log
  filename
  - debian/patches/CVE-2012-1906_CVE-2012-1986_to_CVE-2012-1989.patch
  - CVE-2012-1989
* debian/patches/puppet-12844: Re-fetch the patch from upstream since some
  missing pieces cause 'rake spec' to abort immediately

62. By Marc Cluet on 2012-03-16

[ Marc Cluet ]
* debian/patches/puppet-12844: Cherry picked patch from upstream
  2.7.12 to revert new agent lockfile behaviour as it breaks upgrades
  from versions < 2.7.10. This feature has been pushed out to
  puppet 3.x by upstream.
* debian/puppetmaster-passenger.postinst (LP: #948983)
  - Fixed rack directory location
  - Added proper enabling of apache2 headers mod
* debian/puppetmaster-passenger.postinst (LP: #950183)
  - Make sure we error if puppet config print doesn't work

[ James Page ]
* debian/puppetmaster-passenger.postinst:
  - Ensure upgrades from <= 2.7.11-1 fixup passenger apache
    configuration.