Bug 522547

Summary:	"major security issue" bugfix release imminent
Product:	[Fedora] Fedora	Reporter:	Bill McGonigle <bill-bugzilla.redhat.com>
Component:	bugzilla	Assignee:	Emmanuel Seyman <emmanuel>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	urgent	Docs Contact:
Priority:	low
Version:	11	CC:	emmanuel, itamar
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	3.2.5-1.fc10	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	524309 (view as bug list)		Environment:
Last Closed:	2009-09-19 00:06:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Bill McGonigle 2009-09-10 16:41:42 UTC

It looks like we're going to need some urgent packaging and pushes to stable in very short order:

-------- Original Message --------
Subject: [ANN] Warning: Major Security Release Coming Soon
Date: Wed, 09 Sep 2009 17:06:08 -0700
From: Max Kanat-Alexander <mkanat>
Organization: Bugzilla Project
To: announce

	A major security issue has been discovered in versions of Bugzilla back
to 3.0. We will be releasing a version of Bugzilla which fixes the issue
within 48 hours (possibly within 24 hours), and all administrators
should be ready to perform the upgrade (which does not require any
database changes) shortly after the new version is released.

	If you do not wish to do a full upgrade, patches for just the security
issue will be available. The patches are relatively small and do not
modify very much of Bugzilla.

	-Max Kanat-Alexander
	Release Manager, Bugzilla Project
-------------

Thank you for packaging bugzilla.

Comment 1 Emmanuel Seyman 2009-09-10 19:38:13 UTC

We're ready for this one.

Comment 2 Fedora Update System 2009-09-11 21:57:55 UTC

bugzilla-3.2.5-1.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/bugzilla-3.2.5-1.fc10

Comment 3 Fedora Update System 2009-09-11 21:58:00 UTC

bugzilla-3.2.5-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/bugzilla-3.2.5-1.fc11

Comment 4 Fedora Update System 2009-09-15 07:37:32 UTC

bugzilla-3.2.5-1.fc10 has been pushed to the Fedora 10 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update bugzilla'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F10/FEDORA-2009-9550

Comment 5 Fedora Update System 2009-09-15 07:39:27 UTC

bugzilla-3.2.5-1.fc11 has been pushed to the Fedora 11 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update bugzilla'.  You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F11/FEDORA-2009-9554

Comment 6 Bill McGonigle 2009-09-15 20:56:45 UTC

I had a problem with the update not properly applying.  After debugging it's not really the package's fault, but some improved Requires would help.

It turned out my yum metadata was boned again.  So, I had an previous version of perl-Email-MIME-Encodings.  When checksetup.pl is run in %post, it was complaining about an older version of Email::MIME::Encodings, and not getting to pre-compiling my templates.  So, the symptom was that the version displayed on the web page headers never got updated, even though all the code was installed fine.

Looking at the SPEC, I see:

  Requires: webserver, patchutils, mod_perl, perl(SOAP::Lite), which

I think we need to list all of the current perl module requirements and the versions (when checksetup will fail if they don't meet).

In that case, I'd at least have seen RPM grumble at me rather than silently failing.  Should I file a separate bug?

Comment 7 Emmanuel Seyman 2009-09-16 06:58:41 UTC

(In reply to comment #6)
> 
> I think we need to list all of the current perl module requirements and the
> versions (when checksetup will fail if they don't meet).

Painful but I don't see any other alternatives.
I'll ask around for opinions on this.

> In that case, I'd at least have seen RPM grumble at me rather than silently
> failing.  Should I file a separate bug?  

Yes, please do.

Comment 8 Fedora Update System 2009-09-19 00:06:29 UTC

bugzilla-3.2.5-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2009-09-19 00:11:34 UTC

bugzilla-3.2.5-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.