[ubuntu/lucid-security] puppet 0.25.4-2ubuntu6.3 (Accepted)

[Jamie Strandboge]

puppet (0.25.4-2ubuntu6.3) lucid-security; urgency=low

  * SECURITY UPDATE: k5login can overwrite arbitrary files as root
    - adjust type/k5login.rb to securely open the file before writing to it as
      root. Patch from upstream: a4333c110ad084f205605708eaab52ad243d6c86
    - CVE-2011-3869
  * SECURITY UPDATE: didn't drop privileges before creating and changing
    permissions on SSH keys
    - adjust ssh_authorized_key/parsed.rb to drop privileges before creating
      the ssh directory and setting permissions. Patches based on upstream:
      ce233aa2a511bf6818f28c226144ec5b05a468ee (required for security fix)
      e2c1cd5c957a236f89b9e8cb7b4e4f8769079e8c (security fix)
      8d9575775737c08c6cbfdf7f9a22f2ea4ab21b20 (backported rspec test case)
      0aae5a71a8e3b38cd8d7041f5c40091887c924a8 (fix test when run as root)
    - CVE-2011-3870
  * SECURITY UPDATE: fix predictable temporary filename in ralsh
    - adjust application/resource.rb to use an unpredictable filename. Patch
      from upstream: 21b7192320dbb79a8cfe1fd3e06d0d399c964c0f
    - CVE-2011-3871

Date: Fri, 30 Sep 2011 09:18:51 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel at lists.ubuntu.com>
https://launchpad.net/ubuntu/lucid/+source/puppet/0.25.4-2ubuntu6.3
-------------- next part --------------
Format: 1.8
Date: Fri, 30 Sep 2011 09:18:51 -0500
Source: puppet
Binary: puppet puppetmaster puppet-common vim-puppet puppet-el puppet-testsuite
Architecture: source
Version: 0.25.4-2ubuntu6.3
Distribution: lucid-security
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 puppet     - centralised configuration management for networks
 puppet-common - common files for puppet and puppetmaster
 puppet-el  - Emacs syntax highlighting for puppet manifests
 puppet-testsuite - centralized configuration management control for networks
 puppetmaster - centralised configuration management control daemon
 vim-puppet - Vim syntax highlighting for puppet manifests
Changes: 
 puppet (0.25.4-2ubuntu6.3) lucid-security; urgency=low
 .
   * SECURITY UPDATE: k5login can overwrite arbitrary files as root
     - adjust type/k5login.rb to securely open the file before writing to it as
       root. Patch from upstream: a4333c110ad084f205605708eaab52ad243d6c86
     - CVE-2011-3869
   * SECURITY UPDATE: didn't drop privileges before creating and changing
     permissions on SSH keys
     - adjust ssh_authorized_key/parsed.rb to drop privileges before creating
       the ssh directory and setting permissions. Patches based on upstream:
       ce233aa2a511bf6818f28c226144ec5b05a468ee (required for security fix)
       e2c1cd5c957a236f89b9e8cb7b4e4f8769079e8c (security fix)
       8d9575775737c08c6cbfdf7f9a22f2ea4ab21b20 (backported rspec test case)
       0aae5a71a8e3b38cd8d7041f5c40091887c924a8 (fix test when run as root)
     - CVE-2011-3870
   * SECURITY UPDATE: fix predictable temporary filename in ralsh
     - adjust application/resource.rb to use an unpredictable filename. Patch
       from upstream: 21b7192320dbb79a8cfe1fd3e06d0d399c964c0f
     - CVE-2011-3871
Checksums-Sha1: 
 539d856528a175a612c5760c136c0ab0be834785 2209 puppet_0.25.4-2ubuntu6.3.dsc
 7ca2c416390357ddf646a319d7904708b4c1f88b 45224 puppet_0.25.4-2ubuntu6.3.diff.gz
Checksums-Sha256: 
 5dd176d615ca6eeab100bd2d8260b73dc880dc4f5566461769073ef878f19d40 2209 puppet_0.25.4-2ubuntu6.3.dsc
 35aa7dcc566ea5de82801f35f4be0108644edae4b4fe9c0ab726130acb0ed67e 45224 puppet_0.25.4-2ubuntu6.3.diff.gz
Files: 
 f260404c34d57a0c1c1c0c2b9d1d4aee 2209 admin optional puppet_0.25.4-2ubuntu6.3.dsc
 c9723aa14a1cf5734f26d49596f312bb 45224 admin optional puppet_0.25.4-2ubuntu6.3.diff.gz
Original-Maintainer: Puppet Package Maintainers <pkg-puppet-devel at lists.alioth.debian.org>