CentOS - Sep 2014 - Bash package for CentOS5

Hi!

I have noticed, that our mirror has this package 
bash-3.2-33.el5_11.4.x86_64.rpm, but a lot of other mirror still have 
bash-3.2-33.el5_10.4.x86_64.rpm.
Since bash-3.2-33.el5_11.4.x86_64.rpm was issued on 26-Sep-2014 04:28, 
could this be the product of slower mirror update cycles?

Regards,
Mitja

-- 
--
Mitja Miheli?
ARNES, Tehnolo?ki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia
tel: +386 1 479 8877, fax: +386 1 479 88 78

On 09/30/2014 06:40 AM, Mitja Miheli? wrote:
> Hi!
> 
> I have noticed, that our mirror has this package
> bash-3.2-33.el5_11.4.x86_64.rpm, but a lot of other mirror still have
> bash-3.2-33.el5_10.4.x86_64.rpm.
> Since bash-3.2-33.el5_11.4.x86_64.rpm was issued on 26-Sep-2014 04:28,
> could this be the product of slower mirror update cycles?
> 
> Regards,
> Mitja
> 

Yes ... it will take a few days for every external mirror to update ...
this happens when we have to push 30GB to more than 500 mirrors (at a
point release time).

One of those bash RPMs is in the 5.10 updates directory, the other is in
the 5.11 updates directory.  Both contain the same source code that is
the latest released by Red Hat for EL5 bash right now.

There may be another update released for this soon:

https://access.redhat.com/security/cve/CVE-2014-7187

But at the time of this email, there is no update for that CVE.

If/when any new update is released, it will be built for 5.11 only.

This may also be a good time to reiterate the CentOS update policy.

Whenever we release a new Minor Version (in this case, 5.11), there will
no longer be any updates released in the older minor version (in this
case 5.10).  Therefore, you must upgrade to the latest release in a
major version (in this case CentOS-5, version 5.11) in order to get any
updates moving forward.

This has always been the case for all CentOS releases from the beginning
.. to get any updates you have to be on the latest version and you
should be pointing to only the major version (ie,
<somepath>/5/<arch> ).

5.11 is only 5.10+updates ... if you stay at 5.10, you will get no more
updates, ever.

Also .. if people use the default setup, they only have to run 'yum
update' to get updates .. it is automatic.

If you (or your hosting provider) have modified the default yum
configurations ... then you (or your hosting provider) is responsible to
figure how to get the updates you want moving forward.

Thanks,
Johnny Hughes

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.centos.org/pipermail/centos/attachments/20140930/756f58d0/attachment-0003.sig>

On Tue, Sep 30, 2014 at 07:15:20AM -0500, Johnny Hughes
wrote:
> There may be another update released for this soon:
> 
> https://access.redhat.com/security/cve/CVE-2014-7187
> 
> But at the time of this email, there is no update for that CVE.
Reading that web page, it says:

"Red Hat Product Security does not consider this bug to have any
security impact on the bash packages shipped in Red Hat Enterprise
Linux. A fix for this issue was applied as a hardening in
RHSA-2014:1306, RHSA-2014:1311, and RHSA-2014:1312."

So... is it fixed or not?  Testing with the code on
https://shellshocker.net/ for CVE-2014-7187 doesn't indicate that the
latest bash update is vulnerable. 

I'm curious because you're not the first person I've heard say that
there are still bash updates in the works from RH/CentOS, when all my
research into the published bash CVEs, RHSAs and Bugzilla reports [1]
leads me to think there aren't any new RHSAs forthcoming.  

Am I missing something?

1. https://bugzilla.redhat.com/show_bug.cgi?id=1146804

-- 
Jonathan Billings <billings at negate.org>