security-team July 2015

security-team@lists.fedoraproject.org

10 participants
18 discussions

rpmlint checks for hostname verification
by Hubert Kario 31 Jul '15

31 Jul '15

One of the most common issues with TLS client applications is that they don't perform hostname verification or do it incorrectly (ignore SANs, handle wildcards incorrectly). As a result, often they will accept any certificate signed by any trusted CA. Given that acquiring a certificates can be completely free (even an email certificate will work), it's trivial to MitM such appplications. I'd like to extend rpmlint to perform rudimentary checks to see if that happens[1]. A draft of the proposal to FPC is here: https://fedoraproject.org/wiki/User:Hkario/HostnameChecks Suggestions? 1 - the check would be just "if call to A is present, check if call to B is present", the way setgid, setuid, setgroups is done, just generalised -- Regards, Hubert Kario Quality Engineer, QE BaseOS Security team Web: www.cz.redhat.com Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic

1 0

Meeting notes from 2015-07-30
by Major Hayden 30 Jul '15

30 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ====================================================================================================== #fedora-meeting: Security Team Meeting - Agenda: https://fedoraproject.org/wiki/Security_Team_meetings ====================================================================================================== Meeting started by mhayden at 14:03:44 UTC. The full logs are available at http://meetbot.fedoraproject.org/fedora-meeting/2015-07-30/fedora_security_… . Meeting summary - --------------- * Roll Call (mhayden, 14:04:03) * Outstanding BZ Tickets (mhayden, 14:07:54) * Looks like ~ 518 tickets open right now (i don't have sparks' exact stats, however) (mhayden, 14:08:17) * LINK: https://fedorahosted.org/fesco/ticket/1466 (mhayden, 14:09:29) * jwb reached out to nagios-plugins pkg maintainer (mhayden, 14:12:03) * Open floor discussion/questions/comments (mhayden, 14:20:39) Meeting ended at 14:31:48 UTC. Action Items - ------------ Action Items, by person - ----------------------- * **UNASSIGNED** * (none) People Present (lines said) - --------------------------- * mhayden (28) * d-caf (16) * jsmith (12) * pjp_ (10) * zodbot (5) * jwb (3) * scorneli (2) Generated by `MeetBot`_ 0.1.4 .. _`MeetBot`: http://wiki.debian.org/MeetBot -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJVujWZAAoJEHNwUeDBAR+xDs4QAJpjG09eSA83mv+1WEVRvsu8 EWw+IllwioyKs5jSDFQhqE1qVayvpgyugLVHmszOiyTp6c5kc8r7qfjnMbMxIxQd eJnMHNjmd1WpkJ5VpE17RZGyheBF8tKb8nML9C+vOQPF1sP/a4a2YB9jdNcVkSJr iPia8SlS1A91UboDhbRVTSrE9YbCAbMAnZ2gd+indtjPVTeAKuh7LPtSHtjbn8Lf 0YdgPjlzXC03lrBDfqg7ZLD10tdW7zOH0wS6wFZL3pqZCADGb9IY/qeilvCZJzuj ulWP8OeDq216h/NRPp+OgjLd+G/u9VO/d7VvAgUs+99igIsDKBep1aPWi7MWRuiN m3y/Ex2Z0C4aH8R2dD5PJGS3q9iyOwcoLoWHI+/fgbOoVIgOQC2E0mlVLn0hWbG6 Ut6MAK0Y3PJTZQ8fpONb08OE6NF/5Bse7dz1OJ7CZGJVPY5XB/Wta6XBuGI9yKQJ bzEdXYmYwvHU8a/D/v/9c6sykgtzNeyAIMYiqrdZRHpGEijaiE3aYErZirl9944N vCja1TLWq8atKIA06ZM1ODA1eUPPifteQEBmU7G2X6he4evy0puFijn0pZPNMBMH yjggfN+1xu/hNDRPCx3U5ZjVK4oqc1FVx5nG7EkuCjM6Wy11pTGb1qhcX8kbbGm3 MwxX+kGHtNv6mu5AkAkc =vvm0 -----END PGP SIGNATURE-----

2 1

[Fedocal] Reminder meeting : Security Team Meeting
by Nobody 29 Jul '15

29 Jul '15

Dear all, You are kindly invited to the meeting: Security Team Meeting on 2015-07-30 from 14:00:00 to 15:00:00 UTC At fedora-meeting@Freenode The meeting will be about: More information available at: [https://fedoraproject.org/wiki/Security_Team_meetings](https://fedoraprojec… Source: https://apps.fedoraproject.org/calendar/meeting/2849/

1 0

Suspicious behavior of packagekit
by S.Mohammad Emami Razavi 24 Jul '15

24 Jul '15

I run $ [root@localhost rooster]# journalctl -u packagekit -f -n 5000 in fedora [root@localhost rooster]# cat /etc/redhat-release Fedora release 22 (Twenty Two) and it results something like below lines: Jul 21 06:54:28 localhost.localdomain PackageKit[18871]: uid 1000 is trying to obtain org.freedesktop.packagekit.system-sources-refresh auth (only_trusted:0) Jul 21 06:54:28 localhost.localdomain PackageKit[18871]: uid 1000 obtained auth for org.freedesktop.packagekit.system-sources-refresh Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: refresh-cache transaction /345_edadcabc from uid 1000 finished with success after 2536929ms Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: get-updates transaction /346_aaeccddc from uid 1000 finished with success after 555ms Jul 21 07:36:45 localhost.localdomain PackageKit[18871]: new update-packages transaction /347_eacacecc scheduled from uid 1000 Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: update-packages transaction /347_eacacecc from uid 1000 finished with cancelled-priority after 2594ms Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve transaction /348_caabddad from uid 1000 finished with success after 143ms Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve transaction /349_aabcaabc from uid 1000 finished with success after 83ms Jul 21 07:36:48 localhost.localdomain PackageKit[18871]: resolve transaction /350_dbadaaeb from uid 1000 finished with success after 31ms Jul 21 07:36:50 localhost.localdomain PackageKit[18871]: new update-packages transaction /351_bebbaccb scheduled from uid 1000 Jul 21 09:27:31 localhost.localdomain PackageKit[18871]: update-packages transaction /351_bebbaccb from uid 1000 finished with success after 6640574ms Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve transaction /352_cababcaa from uid 1000 finished with success after 30ms Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve transaction /353_ccabcecc from uid 1000 finished with success after 81ms Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve transaction /354_caddccdb from uid 1000 finished with success after 30ms Jul 21 09:27:35 localhost.localdomain PackageKit[18871]: resolve transaction /355_ddaacaea from uid 1000 finished with success after 278ms Jul 21 09:27:37 localhost.localdomain PackageKit[18871]: get-update-detail transaction /356_dabbaeed from uid 1000 finished with success after 1611ms It has very suspicious and unusual behavior to use network bandwidth. For example in 10 days it downloads over 2GB from net!!! regardless of dnf or yum updates... Any expert with relaxing answer?

2 1

Nagios packages
by David Cafaro 22 Jul '15

22 Jul '15

Hello All, So I have several tickets which it seems the maintainers have not interest in maintaining anymore related to nagios and nagios plugins: https://bugzilla.redhat.com/show_bug.cgi?id=1121500 https://bugzilla.redhat.com/show_bug.cgi?id=1121499 https://bugzilla.redhat.com/show_bug.cgi?id=1098549 https://bugzilla.redhat.com/show_bug.cgi?id=1098548 I’ve got no response from the existing people so I went searching for people. I reached out to the Nagios folks and Scott Wilkerson, Nagios Product Development Manager, is interested in getting someone on their team on board to help maintain the Fedora/CentOS packages. Any recommendations on how best to get them up to speed. As I am not well versed on the package maintainer system I could use some help/guidance in getting them up and running smoothly/quickly. Thanks David

2 5

Another empty meeting...
by Eric Christensen 21 Jul '15

21 Jul '15

====================================================================================================== #fedora-meeting: Security Team Meeting - Agenda: https://fedoraproject.org/wiki/Security_Team_meetings ====================================================================================================== Meeting started by Sparks at 00:00:01 UTC. The full logs are available at http://meetbot.fedoraproject.org/fedora-meeting/2015-07-21/fedora_security_… . Meeting summary --------------- * Roll Call (Sparks, 00:00:06) * Outstanding BZ Tickets (Sparks, 00:10:21) * Monday's numbers: Critical 0 (0), Important 45 (-3), Moderate 361 (+9), Low 149 (-2), Total 509, Trend +4 (Sparks, 00:10:36) * Current tickets owned: 88 (~17%) (Sparks, 00:10:43) * Tickets closed: 352 (+4) (Sparks, 00:10:50) * Open floor discussion/questions/comments (Sparks, 00:10:58) Meeting ended at 00:13:24 UTC. Action Items ------------ Action Items, by person ----------------------- * **UNASSIGNED** * (none) People Present (lines said) --------------------------- * Sparks (14) * zodbot (3) * bojov (2) Generated by `MeetBot`_ 0.1.4 .. _`MeetBot`: http://wiki.debian.org/MeetBot

6 6

[Fedocal] Reminder meeting : Security Team Meeting
by Nobody 19 Jul '15

19 Jul '15

Dear all, You are kindly invited to the meeting: Security Team Meeting on 2015-07-21 from 00:00:00 to 01:00:00 UTC At fedora-meeting(a)irc.freenode.net The meeting will be about: Source: https://apps.fedoraproject.org/calendar/meeting/2840/

1 0

[Fedocal] Reminder meeting : Weekly Security Team meeting
by Eric Christensen 15 Jul '15

15 Jul '15

Dear all, You are kindly invited to the meeting: Weekly Security Team meeting on 2015-07-16 from 14:00:00 to 15:00:00 UTC At fedora-meeting(a)irc.freenode.net The meeting will be about: Weekly meeting of the Security Team. More information available at: [https://fedoraproject.org/wiki/Security_Team_meetings](https://fedoraprojec… Source: https://apps.fedoraproject.org/calendar/meeting/1986/

2 2

Meeting minutes for 2015-07-13
by Eric Christensen 14 Jul '15

14 Jul '15

====================================================================================================== #fedora-meeting: Security Team Meeting - Agenda: https://fedoraproject.org/wiki/Security_Team_meetings ====================================================================================================== Meeting started by Sparks at 00:00:08 UTC. The full logs are available at http://meetbot.fedoraproject.org/fedora-meeting/2015-07-14/fedora_security_… . Meeting summary --------------- * Roll Call (Sparks, 00:00:28) * Outstanding BZ Tickets (Sparks, 00:10:53) * Thursday's numbers: Critical 0 (0), Important 48 (-3), Moderate 352 (-3), Low 151 (0), Total 511, Trend -6 (Sparks, 00:11:05) * Open floor discussion/questions/comments (Sparks, 00:11:16) Meeting ended at 00:13:28 UTC. Action Items ------------ Action Items, by person ----------------------- * **UNASSIGNED** * (none) People Present (lines said) --------------------------- * Sparks (14) * zodbot (3) * jtaylor90 (3)

4 3

[Fedocal] Reminder meeting : Security Team Meeting
by Nobody 12 Jul '15

12 Jul '15

Dear all, You are kindly invited to the meeting: Security Team Meeting on 2015-07-14 from 00:00:00 to 01:00:00 UTC At fedora-meeting(a)irc.freenode.net The meeting will be about: Source: https://apps.fedoraproject.org/calendar/meeting/2840/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

security-team July 2015