Bug 1292680 - backport 611cef1823c43fb5320f79c796ea5e77eb14681f
backport 611cef1823c43fb5320f79c796ea5e77eb14681f
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: lorax (Show other bugs)
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Brian Lane
Release Test Team
Depends On:
  Show dependency treegraph
Reported: 2015-12-17 22:26 EST by Colin Walters
Modified: 2016-11-03 19:45 EDT (History)
2 users (show)

See Also:
Fixed In Version: lorax-19.6.67-1
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2016-11-03 19:45:09 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Colin Walters 2015-12-17 22:26:17 EST
<jbrooks> walters, I'm having trouble getting lorax to use the newer anaconda pkg. I tried incrementing the version from -5 to -6, I've tried various other things, but it wants to stick w/ the version of anaconda in the main repo
<jbrooks> I don't know where the breakage is

... snip 20 minutes of debugging ...

Then I notice it's using COPR's default of an https:// baseurl...

<walters> wait this is triggering a memory for me
<walters> https://github.com/rhinstaller/lorax/commit/611cef1823c43fb5320f79c796ea5e77eb14681f
<walters> and before that commit they were silently ignored
<walters> oh yes
<walters> that commit didn't make it to rhel7-branch
<walters> love when i fix a problem and then a year and a half later i debug it again
<walters> because there were layers and layers of branches and manual integration
<walters> so anyways for now i guess allow anyone with the capability to MITM traffic on the internet to run arbitrary code by just changing it to http://
<walters> (or mirror the repos securely, then use http://, or backport the lorax patch)
<walters> you know what's actually astounding is how many people do yum repos with http://
<walters> i've been tempted to change ostree to explicitly barf if you do this without gpg enabled either
Comment 3 Michal Kovarik 2016-07-28 03:08:37 EDT
Verified in lorax-19.6.74-1.el7, patch is backported.
Comment 5 errata-xmlrpc 2016-11-03 19:45:09 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.