Bug 476635

Summary: nagios: update to version 3.0.6
Product: [Fedora] Fedora Reporter: Jan Lieskovsky <jlieskov>
Component: nagiosAssignee: Mike McGrath <mmcgrath>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 10CC: jose.p.oliveira.oss, mmcgrath, redhat, sebastian.gosenheimer, wtogami
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://www.nagios.org/development/history/nagios-3x.php
Whiteboard:
Fixed In Version: 3.2.0-2.fc10 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-01-11 18:19:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2008-12-16 11:34:57 UTC
Description of problem:
Nagios 3.0.6 has just been released.

Additional info:
Major changes (from http://www.nagios.org/development/history/nagios-3x.php)

3.0.6 - 12/01/2008

* Fix for CGI submission of external commands (writing newlines and submitting 
  service comments)
* Fix for Apache group membership in RPM spec file
* Fix for improper notification propagation command processing
* Better out-of-disk-space error handling when writing retention and status files
* Disabled adaptive check and eventhandler commands for security reasons
* Fix for reading output from system commands (event handlers, etc) that have 
  timed out
* Added wildcard host matching in CGIs
* Fixes for playing audio alerts in CGIs
* Fix for incorrect host status links in status CGI when viewing hostgroup  
  summary
* Added support for x509 cert authentication in the CGIs 

The upstream patch for "* Disabled adaptive check and eventhandler commands for security reasons" is here:
http://nagios.cvs.sourceforge.net/viewvc/nagios/nagios/base/commands.c?r1=1.109&amp;r2=1.110&amp;view=patch

Comment 1 romal 2008-12-16 18:19:17 UTC
3.0.6 is in Rawhide for two weeks. Is Ethan releasing a 3.0.7 to fix the security shortly or do we have to include the patch ?

Comment 2 Jose Pedro Oliveira 2008-12-22 03:11:20 UTC
(In reply to comment #1)
> 3.0.6 is in Rawhide for two weeks. 

Can you also build it for Fedora 10?

> ... Is Ethan releasing a 3.0.7 to fix the
> security shortly or do we have to include the patch ?

The patch is already included in version 3.0.6 (file base/commands.c line 2897).

According to the changelog file the next nagios version will have the 3.1.0 tag
(http://nagios.cvs.sourceforge.net/viewvc/nagios/nagios/Changelog?revision=1.354&view=markup).

Comment 3 romal 2009-01-11 15:31:13 UTC
Hi Mike,

Nagios 3.0.6 builds in Rawhide, but not in F10.

Koji pulls a 3.0.5 in and I have no idea why. Could you have a look please ?

$ cvs -d :pserver:anonymous.org:/cvs/pkgs checkout -r nagios-3_0_6-1_fc10 rpms/nagios/F-10
cvs checkout: Updating rpms/nagios/F-10
U rpms/nagios/F-10/.cvsignore
U rpms/nagios/F-10/Makefile
U rpms/nagios/F-10/branch
U rpms/nagios/F-10/nagios-initrd.patch
U rpms/nagios/F-10/nagios.cfg.patch
U rpms/nagios/F-10/nagios.htaccess
U rpms/nagios/F-10/nagios.htpasswd
U rpms/nagios/F-10/nagios.internet.cfg
U rpms/nagios/F-10/nagios.logrotate
U rpms/nagios/F-10/nagios.spec
U rpms/nagios/F-10/nagios.upgrade_to_v3.ReadMe
U rpms/nagios/F-10/nagios.upgrade_to_v3.sh
U rpms/nagios/F-10/sources
$ cvs -d :pserver:anonymous.org:/cvs/pkgs checkout common
cvs checkout: Updating common
U common/Makefile
U common/Makefile.common
U common/branches
U common/cvs-import.sh
$ make srpm
Downloading nagios-3.0.5.tar.gz...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0 2670k    0  1120    0     0  44764      0  0:01:01 --:--:--  0:01:01 44764
100 2670k  100 2670k    0     0  5111k      0 --:--:-- --:--:-- --:--:-- 5371k
-rw-r--r-- 1 root root 2735018 Nov 24 21:06 nagios-3.0.5.tar.gz
rpmbuild --define "_sourcedir /tmp/koji/tasks/4934/1044934/scmroot/rpms/nagios/F-10" --define "_specdir /tmp/koji/tasks/4934/1044934/scmroot/rpms/nagios/F-10" --define "_builddir /tmp/koji/tasks/4934/1044934/scmroot/rpms/nagios/F-10" --define "_srcrpmdir /tmp/koji/tasks/4934/1044934/scmroot/rpms/nagios/F-10" --define "_rpmdir /tmp/koji/tasks/4934/1044934/scmroot/rpms/nagios/F-10" --define "dist .fc10" --define "fedora 10" --define "fc10 1" --nodeps -bs nagios.spec
error: File /tmp/koji/tasks/4934/1044934/scmroot/rpms/nagios/F-10/nagios-3.0.6.tar.gz: No such file or directory
make: *** [srpm] Error 1


cu romal

Comment 4 Jose Pedro Oliveira 2009-01-11 17:41:22 UTC
Robert,

The sources file was only updated after having being tagged.

See http://cvs.fedoraproject.org/viewvc/rpms/nagios/F-10/sources?view=log

 * sources revision 1.18 is tagged as nagios-3_0_6-1_fc10 but
   its content is the MD5 digest of the file nagios-3.0.5.tar.gz

You need to bump the specfile release and retag everything.

/jpo

Comment 5 Fedora Update System 2009-01-11 18:16:50 UTC
nagios-3.0.6-2.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/nagios-3.0.6-2.fc10

Comment 6 romal 2009-01-11 18:18:55 UTC
Hi,

thanks for the help. I hate CVS. The build worked.

cu romal

Comment 7 Fedora Update System 2009-08-17 19:05:28 UTC
nagios-3.2.0-2.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/nagios-3.2.0-2.fc10

Comment 8 Fedora Update System 2009-08-20 20:55:20 UTC
nagios-3.2.0-2.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.