Bug 1292680

Summary:	backport 611cef1823c43fb5320f79c796ea5e77eb14681f
Product:	Red Hat Enterprise Linux 7	Reporter:	Colin Walters <walters>
Component:	lorax	Assignee:	Brian Lane <bcl>
Status:	CLOSED ERRATA	QA Contact:	Release Test Team <release-test-team-automation>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.3	CC:	mbanas, mkovarik
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	lorax-19.6.67-1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-03 23:45:09 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Colin Walters 2015-12-18 03:26:17 UTC

<jbrooks> walters, I'm having trouble getting lorax to use the newer anaconda pkg. I tried incrementing the version from -5 to -6, I've tried various other things, but it wants to stick w/ the version of anaconda in the main repo
<jbrooks> I don't know where the breakage is

... snip 20 minutes of debugging ...

Then I notice it's using COPR's default of an https:// baseurl...

<walters> wait this is triggering a memory for me
<walters> https://github.com/rhinstaller/lorax/commit/611cef1823c43fb5320f79c796ea5e77eb14681f
<walters> and before that commit they were silently ignored
<walters> oh yes
<walters> that commit didn't make it to rhel7-branch
<walters> love when i fix a problem and then a year and a half later i debug it again
<walters> because there were layers and layers of branches and manual integration
<walters> so anyways for now i guess allow anyone with the capability to MITM traffic on the internet to run arbitrary code by just changing it to http://
<walters> (or mirror the repos securely, then use http://, or backport the lorax patch)
<walters> you know what's actually astounding is how many people do yum repos with http://
<walters> i've been tempted to change ostree to explicitly barf if you do this without gpg enabled either

Comment 3 Michal Kovarik 2016-07-28 07:08:37 UTC

Verified in lorax-19.6.74-1.el7, patch is backported.

Comment 5 errata-xmlrpc 2016-11-03 23:45:09 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2165.html