uprev serf: 1.3.6 -> 1.3.8

PATCH In review [email protected] 3 participants 7 messages Nov 17, 2014 – Nov 19, 2014

lore

Share & tools

lore

[email protected]

author

2014-11-17 08:38 UTC #0 lore raw

cover uprev serf: 1.3.6 -> 1.3.8

From: Wenzong Fan <[email protected]>

Release changes:

Serf 1.3.8 [2014-10-20, from /tags/1.3.8, rxxxx]
Fix issue #152: CRC calculation error for gzipped http reponses > 4GB. Fix issue #153: SSPI CredHandle not freed when APR pool is destroyed. Fix issue #154: Disable SSLv2 and SSLv3 as both or broken.

Serf 1.3.7 [2014-08-11, from /tags/1.3.7, r2411]
Handle NUL bytes in fields of an X.509 certificate. (r2393, r2399)

The following changes since commit edaeb8940813b620090a0797ad3b6a076897512d:

bitbake: cooker.py: fix loginfo op being set to an invalid value (2014-11-12 17:04:50 +0000)

are available in the git repository at:

git://git.pokylinux.org/poky-contrib wenzong/serf
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/serf

Wenzong Fan (1):
serf: 1.3.6 -> 1.3.8

 .../serf/{serf_1.3.6.bb => serf_1.3.8.bb}          |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 rename meta/recipes-support/serf/{serf_1.3.6.bb => serf_1.3.8.bb} (74%)

Signature · 1 line

1.7.9.5

[email protected]

author

2014-11-17 08:38 UTC #1 lore raw

PATCH 1/1 serf: 1.3.6 -> 1.3.8

From: Wenzong Fan <[email protected]>

Release changes:

Serf 1.3.7 [2014-08-11, from /tags/1.3.7, r2411]
Handle NUL bytes in fields of an X.509 certificate. (r2393, r2399)

Signed-off-by Wenzong Fan <[email protected]>

---
 .../serf/{serf_1.3.6.bb => serf_1.3.8.bb}          |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
 rename meta/recipes-support/serf/{serf_1.3.6.bb => serf_1.3.8.bb} (74%)

meta/recipes-support/serf/serf_1.3.8.bb renamed from meta/recipes-support/serf/serf_1.3.6.bb +3 -3

similarity index 74%
rename from meta/recipes-support/serf/serf_1.3.6.bb
rename to meta/recipes-support/serf/serf_1.3.8.bb
index 08b04d3..10db122 100644
@@ -1,8 +1,8 @@
 
-SRC_URI = "http://serf.googlecode.com/svn/src_releases/serf-1.3.6.tar.bz2 \
+SRC_URI = "http://serf.googlecode.com/svn/src_releases/serf-${PV}.tar.bz2 \
            file://norpath.patch"
-SRC_URI[md5sum] = "7fe38fa6eab078e0beabf291d8e4995d"
-SRC_URI[sha256sum] = "ca637beb0399797d4fc7ffa85e801733cd9c876997fac4a4fd12e9afe86563f2"
+SRC_URI[md5sum] = "2e4efe57ff28cb3202a112e90f0c2889"
+SRC_URI[sha256sum] = "e0500be065dbbce490449837bb2ab624e46d64fc0b090474d9acaa87c82b2590"
 
 LICENSE = "Apache-2.0"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327"

Signature · 1 line

1.7.9.5

akuster

2014-11-17 15:43 UTC #2 lore raw

Re: [PATCH 1/1] serf: 1.3.6 -> 1.3.8

Since Dizzy would need the security fix in serf 1.3.7, would I backport 1.3.8 to Dizzy from master or do we need a separate 1.3.7 update for Dizzy?

- Armin

Quoted 38 lines · On 11/17/2014 12:38 AM, [email protected] wrote:

From: Wenzong Fan <[email protected]>
Release changes:
Serf 1.3.8 [2014-10-20, from /tags/1.3.8, rxxxx]
Fix issue #152: CRC calculation error for gzipped http reponses > 4GB. Fix issue #153: SSPI CredHandle not freed when APR pool is destroyed. Fix issue #154: Disable SSLv2 and SSLv3 as both or broken.
Serf 1.3.7 [2014-08-11, from /tags/1.3.7, r2411]
Handle NUL bytes in fields of an X.509 certificate. (r2393, r2399)
Signed-off-by Wenzong Fan <[email protected]>
---
  .../serf/{serf_1.3.6.bb => serf_1.3.8.bb}          |    6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
rename meta/recipes-support/serf/{serf_1.3.6.bb => serf_1.3.8.bb} (74%)
meta/recipes-support/serf/serf_1.3.8.bb renamed from meta/recipes-support/serf/serf_1.3.6.bb +3 -3
similarity index 74%
rename from meta/recipes-support/serf/serf_1.3.6.bb
rename to meta/recipes-support/serf/serf_1.3.8.bb
index 08b04d3..10db122 100644
@@ -1,8 +1,8 @@
 
-SRC_URI = "http://serf.googlecode.com/svn/src_releases/serf-1.3.6.tar.bz2 \
+SRC_URI = "http://serf.googlecode.com/svn/src_releases/serf-${PV}.tar.bz2 \
             file://norpath.patch"
-SRC_URI[md5sum] = "7fe38fa6eab078e0beabf291d8e4995d"
-SRC_URI[sha256sum] = "ca637beb0399797d4fc7ffa85e801733cd9c876997fac4a4fd12e9afe86563f2"
+SRC_URI[md5sum] = "2e4efe57ff28cb3202a112e90f0c2889"
+SRC_URI[sha256sum] = "e0500be065dbbce490449837bb2ab624e46d64fc0b090474d9acaa87c82b2590"
 
  LICENSE = "Apache-2.0"
  LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327"

Mark Hatle

2014-11-17 16:29 UTC #3 lore raw

Re: [PATCH 1/1] serf: 1.3.6 -> 1.3.8

Quoted 2 lines · akuster

Since Dizzy would need the security fix in serf 1.3.7, would I backport 1.3.8 to Dizzy from master or do we need a separate 1.3.7 update for Dizzy?

Unless there is no way to backport, usual process is a separate 1.3.7 update for Dizzy.

--Mark

Quoted 42 lines

- Armin
Quoted 38 lines · On 11/17/2014 12:38 AM, [email protected] wrote:
From: Wenzong Fan <[email protected]>
Release changes:
Serf 1.3.8 [2014-10-20, from /tags/1.3.8, rxxxx]
Fix issue #152: CRC calculation error for gzipped http reponses > 4GB. Fix issue #153: SSPI CredHandle not freed when APR pool is destroyed. Fix issue #154: Disable SSLv2 and SSLv3 as both or broken.
Serf 1.3.7 [2014-08-11, from /tags/1.3.7, r2411]
Handle NUL bytes in fields of an X.509 certificate. (r2393, r2399)
Signed-off-by Wenzong Fan <[email protected]>
---
   .../serf/{serf_1.3.6.bb => serf_1.3.8.bb}          |    6 +++---
   1 file changed, 3 insertions(+), 3 deletions(-)
rename meta/recipes-support/serf/{serf_1.3.6.bb => serf_1.3.8.bb} (74%)
meta/recipes-support/serf/serf_1.3.8.bb renamed from meta/recipes-support/serf/serf_1.3.6.bb +3 -3
similarity index 74%
rename from meta/recipes-support/serf/serf_1.3.6.bb
rename to meta/recipes-support/serf/serf_1.3.8.bb
index 08b04d3..10db122 100644
@@ -1,8 +1,8 @@
 
-SRC_URI = "http://serf.googlecode.com/svn/src_releases/serf-1.3.6.tar.bz2 \
+SRC_URI = "http://serf.googlecode.com/svn/src_releases/serf-${PV}.tar.bz2 \
              file://norpath.patch"
-SRC_URI[md5sum] = "7fe38fa6eab078e0beabf291d8e4995d"
-SRC_URI[sha256sum] = "ca637beb0399797d4fc7ffa85e801733cd9c876997fac4a4fd12e9afe86563f2"
+SRC_URI[md5sum] = "2e4efe57ff28cb3202a112e90f0c2889"
+SRC_URI[sha256sum] = "e0500be065dbbce490449837bb2ab624e46d64fc0b090474d9acaa87c82b2590"
 
   LICENSE = "Apache-2.0"
   LIC_FILES_CHKSUM = "file://LICENSE;md5=86d3f3a95c324c9479bd8986968f4327"

akuster

2014-11-17 15:35 UTC #4 lore raw

In reply to [email protected]

Please add to the 1.3.7 the security fix

- CVE-2014-3504: (Closes: #757965)

Quoted 28 lines · On 11/17/2014 12:38 AM, [email protected] wrote:

From: Wenzong Fan <[email protected]>
Release changes:
Serf 1.3.8 [2014-10-20, from /tags/1.3.8, rxxxx]
Fix issue #152: CRC calculation error for gzipped http reponses > 4GB. Fix issue #153: SSPI CredHandle not freed when APR pool is destroyed. Fix issue #154: Disable SSLv2 and SSLv3 as both or broken.
Serf 1.3.7 [2014-08-11, from /tags/1.3.7, r2411]
Handle NUL bytes in fields of an X.509 certificate. (r2393, r2399)
The following changes since commit edaeb8940813b620090a0797ad3b6a076897512d:
bitbake: cooker.py: fix loginfo op being set to an invalid value (2014-11-12 17:04:50 +0000)
are available in the git repository at:
git://git.pokylinux.org/poky-contrib wenzong/serf
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/serf
Wenzong Fan (1):
   serf: 1.3.6 -> 1.3.8
  .../serf/{serf_1.3.6.bb => serf_1.3.8.bb}          |    6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
rename meta/recipes-support/serf/{serf_1.3.6.bb => serf_1.3.8.bb} (74%)

wenzong fan

author

2014-11-18 02:58 UTC #5 lore raw

Quoted 3 lines · akuster

Please add to the 1.3.7 the security fix
- CVE-2014-3504: (Closes: #757965)

Ok, I have added this comment and updated the contrib branch.

Thanks
Wenzong

Quoted 33 lines · On 11/17/2014 12:38 AM, [email protected] wrote:

Quoted 30 lines
From: Wenzong Fan <[email protected]>
Release changes:
Serf 1.3.8 [2014-10-20, from /tags/1.3.8, rxxxx]
Fix issue #152: CRC calculation error for gzipped http reponses > 4GB. Fix issue #153: SSPI CredHandle not freed when APR pool is destroyed. Fix issue #154: Disable SSLv2 and SSLv3 as both or broken.
Serf 1.3.7 [2014-08-11, from /tags/1.3.7, r2411]
Handle NUL bytes in fields of an X.509 certificate. (r2393, r2399)
The following changes since commit
edaeb8940813b620090a0797ad3b6a076897512d:
bitbake: cooker.py: fix loginfo op being set to an invalid value
(2014-11-12 17:04:50 +0000)
are available in the git repository at:
git://git.pokylinux.org/poky-contrib wenzong/serf
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/serf
Wenzong Fan (1):
   serf: 1.3.6 -> 1.3.8
  .../serf/{serf_1.3.6.bb => serf_1.3.8.bb}          |    6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
rename meta/recipes-support/serf/{serf_1.3.6.bb => serf_1.3.8.bb} (74%)

wenzong fan

author

2014-11-19 01:46 UTC #6 lore raw

In reply to akuster

As https://subversion.apache.org/security/CVE-2014-3522-advisory.txt mentioned:

We recommend all users to upgrade to Subversion 1.8.10. Users of Subversion 1.7.x or 1.8.x who are unable to upgrade may apply the included patch. We also recommend that all users upgrade to Serf 1.3.7 or newer to resolve CVE-2014-3504.

The subversion has been 1.8.10 on master and we only need to uprev serf now.

Akuster,

I wonder how would you like to process this on Dizzy?

Uprev subversion or just apply related CVE fixes, I did think the serf should be uprev-ed.

Thanks
Wenzong

Quoted 36 lines · akuster

Please add to the 1.3.7 the security fix
- CVE-2014-3504: (Closes: #757965)
Quoted 30 lines · On 11/17/2014 12:38 AM, [email protected] wrote:
From: Wenzong Fan <[email protected]>
Release changes:
Serf 1.3.8 [2014-10-20, from /tags/1.3.8, rxxxx]
Fix issue #152: CRC calculation error for gzipped http reponses > 4GB. Fix issue #153: SSPI CredHandle not freed when APR pool is destroyed. Fix issue #154: Disable SSLv2 and SSLv3 as both or broken.
Serf 1.3.7 [2014-08-11, from /tags/1.3.7, r2411]
Handle NUL bytes in fields of an X.509 certificate. (r2393, r2399)
The following changes since commit
edaeb8940813b620090a0797ad3b6a076897512d:
bitbake: cooker.py: fix loginfo op being set to an invalid value
(2014-11-12 17:04:50 +0000)
are available in the git repository at:
git://git.pokylinux.org/poky-contrib wenzong/serf
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=wenzong/serf
Wenzong Fan (1):
   serf: 1.3.6 -> 1.3.8
  .../serf/{serf_1.3.6.bb => serf_1.3.8.bb}          |    6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)
rename meta/recipes-support/serf/{serf_1.3.6.bb => serf_1.3.8.bb} (74%)