| Summary: | <net-analyzer/nagios-core-4.2.0: snoopy: command execution via shell metacharacters (CVE-2008-4796) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Tomáš Mózes <hydrapolic> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | andrew, bug, creffett, mjo, proxy-maint, sysadmin |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | B2 [glsa cve] | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Tomáš Mózes
2016-09-26 12:22:27 UTC
Upstream merged the patches for 4.1.1 and after removing them nagios compiles fine, our instance seems to be running ok. The fixed version is in the tree. During stabilization, please also get the metapackage =net-analyzer/nagios-4.2.1. I also updated the ebuild to EAPI=6 and dropped the depend.apache, multilib, and eutils eclasses. I'm fairly sure that depend.apache.eclass was only being used to define $APACHE2_MODULES_CONFDIR (which I inlined), but I would feel better if someone who uses the web interface tests it. (In reply to Michael Orlitzky from comment #2) > The fixed version is in the tree. During stabilization, please also get the > metapackage =net-analyzer/nagios-4.2.1. > > I also updated the ebuild to EAPI=6 and dropped the depend.apache, multilib, > and eutils eclasses. I'm fairly sure that depend.apache.eclass was only > being used to define $APACHE2_MODULES_CONFDIR (which I inlined), but I would > feel better if someone who uses the web interface tests it. Thanks Michael. Tested with USE="apache2 web" and works ok. CVE-2013-4214 was handled by bug 480352. Added to an existing GLSA. This issue was resolved and addressed in GLSA 201702-26 at https://security.gentoo.org/glsa/201702-26 by GLSA coordinator Thomas Deutschmann (whissi). |
