security-team October 2016

security-team@lists.fedoraproject.org

6 participants
5 discussions

[Fedocal] Reminder meeting : Security Team Meeting
by Nobody 20 Oct '16

20 Oct '16

Dear all, You are kindly invited to the meeting: Security Team Meeting on 2016-10-20 from 14:00:00 to 15:00:00 UTC At fedora-meeting(a)irc.freenode.net The meeting will be about: More information available at: [https://fedoraproject.org/wiki/Security_Team_meetings](https://fedoraprojec… Source: https://apps.fedoraproject.org/calendar/meeting/2849/

2 1

[Fedocal] Reminder meeting : Security Team Meeting
by Nobody 12 Oct '16

12 Oct '16

Dear all, You are kindly invited to the meeting: Security Team Meeting on 2016-10-13 from 14:00:00 to 15:00:00 UTC At fedora-meeting(a)irc.freenode.net The meeting will be about: More information available at: [https://fedoraproject.org/wiki/Security_Team_meetings](https://fedoraprojec… Source: https://apps.fedoraproject.org/calendar/meeting/2849/

1 0

including EOL and vulnerable software in Fedora
by Dominik 'Rathann' Mierzejewski 07 Oct '16

07 Oct '16

Dear All, I was made aware that EOL software with known security bugs that will not be fixed upstream (due to EOL status) was reviewed and accepted into Fedora recently. This came on the back of the FPC ticket [1] asking to make some changes in the Python Packaging Guidelines. I did go back and re-read our current guidelines and found that we don't have any policy on that. As a result, I opened a FESCo ticket [2] with the aim of establishing a clear policy on how to treat EOL software with known security vulnerabilities. My proposal is: 1. Prevent EOL software with known security vulnerabilities from entering Fedora in the first place, i.e. make it a review bullet point (if the package is EOL it MUST NOT have any known security vulnerabilties). If existing packages are found to be EOL and have known security vulnerabilities, the vulnerability must either be patched by the maintainer (or otherwise handled, e.g. by switching to an actively maintained fork) or the package must be removed from Fedora. 2. A ticket may be opened to FESCo applying for an exception to the above. FESCo should most likely seek the advice of the Fedora Security Team in such cases. Please read comments in both referenced tickets to avoid repeating arguments which were given already. References: [1] https://fedorahosted.org/fpc/ticket/650 [2] https://fedorahosted.org/fesco/ticket/1634 Regards, Dominik -- Fedora http://fedoraproject.org/wiki/User:Rathann RPMFusion http://rpmfusion.org "Faith manages." -- Delenn to Lennier in Babylon 5:"Confessions and Lamentations"

4 3

Fedora Security Team Report - 2016-10-06
by Major Hayden 06 Oct '16

06 Oct '16

__ _ / _| ___ __| | ___ _ __ __ _ | |_ / _ \/ _` |/ _ \| '__/ _` | Fedora Security Team Report | _| __/ (_| | (_) | | | (_| | Report date: 2016-10-06 08:40:57.172186 |_| \___|\__,_|\___/|_| \__,_| Data from: 2016-10-06 ------------------------------------------------------------------------------- +Tickets by Priority----+-------+---------+ | Priority | Tickets | Owned | Unowned | +-------------+---------+-------+---------+ | medium | 639 | 31 | 608 | | low | 223 | 11 | 212 | | high | 110 | 19 | 91 | | unspecified | 1 | 0 | 1 | +-------------+---------+-------+---------+ +Tickets by Status---+-------+---------+ | Status | Tickets | Owned | Unowned | +----------+---------+-------+---------+ | NEW | 841 | 54 | 787 | | ON_QA | 95 | 3 | 92 | | ASSIGNED | 25 | 3 | 22 | | MODIFIED | 12 | 1 | 11 | +----------+---------+-------+---------+ +Tickets by Severity-+-------+---------+ | Severity | Tickets | Owned | Unowned | +----------+---------+-------+---------+ | medium | 640 | 31 | 609 | | low | 223 | 11 | 212 | | high | 110 | 19 | 91 | +----------+---------+-------+---------+ +Tickets by Component-----+-------+---------+ | Component | Tickets | Owned | Unowned | +---------------+---------+-------+---------+ | qemu | 29 | 4 | 25 | | ImageMagick | 19 | 0 | 19 | | mingw-libxml2 | 17 | 0 | 17 | | bugzilla | 13 | 1 | 12 | | imlib2 | 12 | 0 | 12 | | mingw-jasper | 12 | 0 | 12 | | mingw-libtiff | 11 | 0 | 11 | | libdwarf | 10 | 0 | 10 | | libarchive | 10 | 0 | 10 | | mingw-openssl | 10 | 0 | 10 | +---------------+---------+-------+---------+ +Tickets by Distro Version-+-------+---------+ | Distro Version | Tickets | Owned | Unowned | +----------------+---------+-------+---------+ | el6 | 307 | 29 | 278 | | 23 | 230 | 12 | 218 | | 24 | 214 | 0 | 214 | | el5 | 113 | 17 | 96 | | epel7 | 101 | 3 | 98 | | 25 | 4 | 0 | 4 | | rawhide | 4 | 0 | 4 | +----------------+---------+-------+---------+ -- Major Hayden

1 0

[Fedocal] Reminder meeting : Security Team Meeting
by Nobody 05 Oct '16

05 Oct '16

Dear all, You are kindly invited to the meeting: Security Team Meeting on 2016-10-06 from 14:00:00 to 15:00:00 UTC At fedora-meeting(a)irc.freenode.net The meeting will be about: More information available at: [https://fedoraproject.org/wiki/Security_Team_meetings](https://fedoraprojec… Source: https://apps.fedoraproject.org/calendar/meeting/2849/

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

security-team October 2016