* Pacemaker fixes to allow fence-agents to work correctly (LP: #1866119)
- d/p/lp1866119-Fix-crmd-avoid-double-free.patch: fix double free
causing intermittent errors
- d/p/lp1866119-Fix-attrd-ensure-node-name-is-broadcast.patch: fix
hang on shutdown issue.
- d/p/lp1866119-Refactor-pengine-functionize.patch: small needed delta
to allow the unfence fix.
- d/p/lp1866119-Fix-pengine-unfence-before-probing.patch: allows
fence-agents to start correctly (LP #1865523)
New changelog entries:
* SECURITY UPDATE: DoS and local privilege escalation in client-server
authentication
- debian/patches/CVE-2018-1687x-1.patch: make crm_pid_active more
precise as to when detections fail in include/crm_internal.h,
lib/common/utils.c.
- debian/patches/CVE-2018-1687x-2.patch: add new helpers to allow IPC
client side to authenticate the server in configure.ac,
include/crm/common/Makefile.am, include/crm/common/ipc.h,
include/crm/common/ipc_internal.h, lib/common/ipc.c.
- debian/patches/CVE-2018-1687x-3.patch: pacemakerd to trust
pre-existing processes via new checks instead in mcp/pacemaker.c.
- debian/patches/CVE-2018-1687x-4.patch: other daemons to authenticate
IPC servers of fellow processes in lib/cluster/corosync.c,
lib/cluster/cpg.c, lib/common/ipc.c, mcp/corosync.c.
- debian/patches/CVE-2018-1687x-5.patch: CPG users to be careful about
now-more-probable rival processes in attrd/main.c, cib/main.c,
crmd/main.c, fencing/main.c, lib/cluster/cpg.c.
- debian/patches/CVE-2018-1687x-6.patch: fix possible NULL pointer
dereference in crmd/control.c.
- debian/libcrmcommon3.symbols: added new symbols.
- CVE-2018-16877
- CVE-2018-16878
* SECURITY UPDATE: information disclosure via use-after-free
- debian/patches/CVE-2019-3885.patch: fix alert handling in
lib/services/services.c, lib/services/services_linux.c.
- CVE-2019-3885
New changelog entries:
* Merge with Debian unstable (LP: #1743059). Remaining changes:
- d/control: Demote fence-agents to Suggests, avoiding main
inclusion.
* Drop:
- d/control: Promote crmsh | pcs to Recommends for upgraders from
14.04.
[ Not needed since 16.10 ]
* Properly restart corosync and pacemaker together (LP: #1740892)
- d/pacemaker.preinst: flag corosync to restart pacemaker on
upgrade.
- d/pacemaker.postinst: clear flag unconditionally in case of errors
+ The preinst and postinst changes can be dropped after bionic
releases as long as the other changes are maintained.
- debian/patches/pacemaker_is_partof_corosync.patch: Default systemd
unit hard-requires corosync. LP #1740892.
- d/pacemaker.postinst: clear flag unconditionally in case of errors
+ The preinst and postinst changes can be dropped after bionic
releases as long as the other changes are maintained.
