[ubuntu/maverick-security] puppet 2.6.1-0ubuntu2.2 (Accepted)

[Jamie Strandboge]

puppet (2.6.1-0ubuntu2.2) maverick-security; urgency=low

  * SECURITY UPDATE: k5login can overwrite arbitrary files as root
    - debian/patches/CVE-2011-3869.patch: adjust type/k5login.rb to securely
      open the file before writing to it as root
    - CVE-2011-3869
  * SECURITY UPDATE: didn't drop privileges before creating and changing
    permissions on SSH keys
    - debian/patches/CVE-2011-3870.patch: adjust ssh_authorized_key/parsed.rb
      to drop privileges before creating the ssh directory and setting
      permissions
    - CVE-2011-3870
  * SECURITY UPDATE: fix predictable temporary filename in ralsh
    - debian/patches/CVE-2011-3871.patch: adjust application/resource.rb to
      use an unpredictable filename
    - CVE-2011-3871
  * SECURITY UPDATE: file indirector injection, similar to CVE-2011-3848
    - secure-indirector-file-backed-terminus-base-cla.patch: Since the
      indirector file backed terminus base class is only used by the test
      suite, remove it and update test cases to use a continuing class.

Date: Fri, 30 Sep 2011 09:04:20 -0500
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/maverick/+source/puppet/2.6.1-0ubuntu2.2
-------------- next part --------------
Format: 1.8
Date: Fri, 30 Sep 2011 09:04:20 -0500
Source: puppet
Binary: puppet puppetmaster-common puppetmaster puppetmaster-passenger puppet-common vim-puppet puppet-el puppet-testsuite
Architecture: source
Version: 2.6.1-0ubuntu2.2
Distribution: maverick-security
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Jamie Strandboge <jamie at ubuntu.com>
Description: 
 puppet     - Centralized configuration management - agent startup and compatib
 puppet-common - Centralized configuration management
 puppet-el  - syntax highlighting for puppet manifests in emacs
 puppet-testsuite - Centralized configuration management - test suite
 puppetmaster - Centralized configuration management - master startup and compati
 puppetmaster-common - Puppet master common scripts
 puppetmaster-passenger - Centralised configuration management - master setup to run under
 vim-puppet - syntax highlighting for puppet manifests in vim
Changes: 
 puppet (2.6.1-0ubuntu2.2) maverick-security; urgency=low
 .
   * SECURITY UPDATE: k5login can overwrite arbitrary files as root
     - debian/patches/CVE-2011-3869.patch: adjust type/k5login.rb to securely
       open the file before writing to it as root
     - CVE-2011-3869
   * SECURITY UPDATE: didn't drop privileges before creating and changing
     permissions on SSH keys
     - debian/patches/CVE-2011-3870.patch: adjust ssh_authorized_key/parsed.rb
       to drop privileges before creating the ssh directory and setting
       permissions
     - CVE-2011-3870
   * SECURITY UPDATE: fix predictable temporary filename in ralsh
     - debian/patches/CVE-2011-3871.patch: adjust application/resource.rb to
       use an unpredictable filename
     - CVE-2011-3871
   * SECURITY UPDATE: file indirector injection, similar to CVE-2011-3848
     - secure-indirector-file-backed-terminus-base-cla.patch: Since the
       indirector file backed terminus base class is only used by the test
       suite, remove it and update test cases to use a continuing class.
Checksums-Sha1: 
 b1565150c6fe5d839f3c6d6eadf0a083c934304a 2296 puppet_2.6.1-0ubuntu2.2.dsc
 29922084667b42f396d1c5583eb644cd10ea5538 41769 puppet_2.6.1-0ubuntu2.2.debian.tar.gz
Checksums-Sha256: 
 ca24eb2029d91d490a06c67aa78914c7e05620bd5870ed6d779f8005cb003703 2296 puppet_2.6.1-0ubuntu2.2.dsc
 f3f089169e810316cfe92b0f7adb9029a0c111eb6e023450d9a832c0f3136bc0 41769 puppet_2.6.1-0ubuntu2.2.debian.tar.gz
Files: 
 17863c8519c1a7ff5a1f560d41bee91f 2296 admin optional puppet_2.6.1-0ubuntu2.2.dsc
 12a81c36eb830f7c6de3e65e24c315ff 41769 admin optional puppet_2.6.1-0ubuntu2.2.debian.tar.gz
Original-Maintainer: Puppet Package Maintainers <pkg-puppet-devel at lists.alioth.debian.org>