Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 569
Alerts This Week
Warning Icon 1 569

Fedora 24 Advisory: 2017-a73bc7ac5d Critical Validation Fix in Fedmsg

fedora
Calendar Grey January 27, 2017
Scroller Fedora
Enhances authentication procedures in fedmsg, guaranteeing accurate signature verifications. Upgrade your Fedora 24 systems without delay.
Fix validation logic in the base consumer The base consumer is intended to only derive its validation switch from the on-disk configuration if the child class doesn't override the ...

Summary

Python API used around Fedora Infrastructure to send and receive messages with

zeromq. Includes some CLI tools.

Update Information:

Fix validation logic in the base consumer The base consumer is intended to only derive its validation switch from the on-disk configuration if the child class doesn't override the validate_signatures switch. There was a bug here where the default value provided in the base class made it appear as if *all* child consumers had turned *off* validation, which is incorrect. This fix turns on signature validation by default while preserving the ability of child consumersto override the on-disk configuration in special cases. - Fixes: CVE-2017-1000001 - Reviewed-by: Patrick Uiterwijk

Topics%20covered

Topics Covered

security advisory fedora update critical signature check validation fedmsg

Change Log

References

Fedora Update Notification FEDORA-2017-a73bc7ac5d 2017-01-27 18:29:56.052283
Name : fedmsg Product : Fedora 24 Version : 0.18.2 Release : 1.fc24 URL : https://github.com/fedora-infra/fedmsg Summary : Tools for Fedora Infrastructure real-time messaging Description : Python API used around Fedora Infrastructure to send and receive messages with zeromq. Includes some CLI tools.

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade fedmsg' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html

Severity
critical
Lowest
Low
Medium
High
Critical

Name: fedmsg
Product: Fedora 24
Version: 0.18.2
Release: 1.fc24
URL: https://github.com/fedora-infra/fedmsg
Summary: Tools for Fedora Infrastructure real-time messaging

Topics%20covered

Topics Covered

security advisory fedora update critical signature check validation fedmsg

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.