Skip to contentSkip to conversation

supervisor: security bump to version 3.1.4

PATCH New Peter Korsgaard 2 participants 4 messages Sep 7, 2017 – Oct 16, 2017

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

PATCH 1/1 supervisor: security bump to version 3.1.4

Fixes CVE-2017-11610 - The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

For more details, see
https://github.com/Supervisor/supervisor/issues/964

While we're at it, add hashes for the license files.

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/supervisor/supervisor.hash | 4 +++-
 package/supervisor/supervisor.mk   | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)
package/supervisor/supervisor.hash +3 -1
index 03f337e7d0..0ebc663be9 100644
@@ -1,2 +1,4 @@
 # Locally calculated
-sha256 e32c546fe8d2a6e079ec4819c49fd24534d4075a58af39118d04367918b3c282  supervisor-3.1.3.tar.gz
+sha256 82f75089f719a7a3ca87f35c89a03c20fd3c0912552c96eb6fa40274ced6604e  supervisor-3.1.4.tar.gz
+sha256 a85a622378c6a892ead1ce5d0488e446e106bf014d3b763fdbc1ad1ae38ee491  COPYRIGHT.txt
+sha256 27ba0b2357ed6974d755ed53232c5ab8595622b3111bb91682708ea188cc3696  LICENSES.txt
package/supervisor/supervisor.mk +2 -2
index 4c62b66feb..9b93b449a7 100644
@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-SUPERVISOR_VERSION = 3.1.3
-SUPERVISOR_SITE = http://pypi.python.org/packages/source/s/supervisor
+SUPERVISOR_VERSION = 3.1.4
+SUPERVISOR_SITE = https://pypi.python.org/packages/12/50/cd330d1a0daffbbe54803cb0c4c1ada892b5d66db08befac385122858eee
 SUPERVISOR_LICENSE = BSD-like, rdflib (http_client.py), PSF (medusa), ZPL-2.1
 SUPERVISOR_LICENSE_FILES = COPYRIGHT.txt LICENSES.txt
 SUPERVISOR_SETUP_TYPE = setuptools
Signature · 1 line
2.11.0
Applied
#1 lore raw

PATCH 1/1 supervisor: security bump to version 3.1.4

Hello,

Quoted 8 lines · Peter Korsgaard

Fixes CVE-2017-11610 - The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

For more details, see
https://github.com/Supervisor/supervisor/issues/964

Quoted 7 lines

While we're at it, add hashes for the license files.

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/supervisor/supervisor.hash | 4 +++-
 package/supervisor/supervisor.mk   | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

Applied to master, thanks.

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com
author
#2 lore raw

PATCH 1/1 supervisor: security bump to version 3.1.4

In reply to Peter Korsgaard
Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes CVE-2017-11610 - The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Quoted 6 lines

For more details, see
https://github.com/Supervisor/supervisor/issues/964

While we're at it, add hashes for the license files.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard
author
#3 lore raw

PATCH 1/1 supervisor: security bump to version 3.1.4

In reply to Peter Korsgaard
Quoted 7 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes CVE-2017-11610 - The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

Quoted 6 lines

For more details, see
https://github.com/Supervisor/supervisor/issues/964

While we're at it, add hashes for the license files.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2017.08.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard