search for: xsas

On Sat, Feb 20, 2016 at 9:24 PM, Sarah Newman <srn at prgmr.com> wrote: > On 02/17/2016 04:30 AM, George Dunlap wrote: >> I have the following packages going through the CBS: >> * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 >> * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 >> * A CentOS 6 xen-4.4.3-11, with XSAs 170 >> >> All these should show up in mirrors hopefully sometime later today. >> As usual, please report any problems here. > > Domains using the distribution p...

I have the following packages going through the CBS: * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 * A CentOS 6 xen-4.4.3-11, with XSAs 170 All these should show up in mirrors hopefully sometime later today. As usual, please report any problems here. Xen 4.4 only has XSA 170 because at the time the embargo was lifted, I didn't hav...

On Wed, Feb 17, 2016 at 12:30 PM, George Dunlap <dunlapg at umich.edu> wrote: > I have the following packages going through the CBS: > * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 > * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 > * A CentOS 6 xen-4.4.3-11, with XSAs 170 > > All these should show up in mirrors hopefully sometime later today. > As usual, please report any problems here. > > Xen 4.4 only has XSA 170 because at the time the emb...

On 02/17/2016 04:30 AM, George Dunlap wrote: > I have the following packages going through the CBS: > * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 > * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 > * A CentOS 6 xen-4.4.3-11, with XSAs 170 > > All these should show up in mirrors hopefully sometime later today. > As usual, please report any problems here. Domains using the distribution provided pvgrub won't boo...

On 23/02/16 15:04, George Dunlap wrote: > On Sat, Feb 20, 2016 at 9:24 PM, Sarah Newman <srn at prgmr.com> wrote: >> On 02/17/2016 04:30 AM, George Dunlap wrote: >>> I have the following packages going through the CBS: >>> * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 >>> * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 >>> * A CentOS 6 xen-4.4.3-11, with XSAs 170 >>> >>> All these should show up in mirrors hopefully sometime later today. >>> As usual, please report any problems here. >> >> Doma...

Just a heads-up -- 4.6.3-2, for both CentOS 7 and CentOS 6, are making their way through the build system now and should be in the mirrors hopefully sometime later this afternoon. These contain patches for XSAs 185-188, one of which is a fairly critical update, so please update as soon as they're available. -George

Just to let people know what's going on: The embargo for XSA-135 lifted today at 1400 UTC. The embargoes for XSAs 134 and 136 lift tomorrow at 1200 UTC. XSA-135 only affects guests which have been assigned a PCNET emulated NIC, which is not the default; as such, it doesn't seem terribly urgent to push the fix today. So rather than push one fix today and another tomorrow, our plan is just to do a single u...

Just a heads-up: A Xen package with XSAs through 163 is on its way through the build system. I'll send an announcement when I've tagged it as ready to be propagated to the mirrors. As with the last XSA update, it will depend on having manually updated to the new Virt SIG repository layout. If you haven't already please run...

XSA 169 is out, but is low-priority and has a work-around, so I'm going to batch it together with XSAs 167-168 and release a new 4.4.3 package when the embargo is lifted next Wednesday. This will be the last XSA update for the 4.4.3 packages. Today or tomorrow I will push the Xen 4.6.0 packages to buildlogs for testing; and sometime after the final 4.4.3 packages are released, I will push the Xen...

...umber of open security issues in Xen. Due to the complexity of the patches that address XSA-273 [0] the packages have been built from upstream's staging-4.8 / staging-4.10 branch again as recommended in that advisory. Commits on those branches are restricted to those that address the following XSAs (cf. [1]): - XSA-273 (CVE-2018-3620, CVE-2018-3646) - XSA-272 (no CVE yet) - XSA-269 (no CVE yet) - XSA-268 (no CVE yet) In addition to the XSAs mentioned above that will be addressed by the upcoming upload (i.e. 4.8.4+xsa273+shim4.10.1+xsa273-1+deb9u10) security updates that address XSA-270 [2]...

...buildlogs.centos.org, and signed packages should be making their way through the mirror system in the near future. Updated package sources can be found in the virt sig area on CentOS: https://github.com/CentOS-virt7/xen https://github.com/CentOS-virt7/xen-kernel The packages contain updates for XSAs 155, 157, 164, 165, and 166 (released today), as well as patches for XSA-142 and an update to XSA-158. For those urgent to install the updated packages, you can get them from buildlogs by enabling the centos-virt-xen-testing repository: yum --enablerepo=centos-virt-xen-testing update Please repo...

xen-4.4.3-10.el6 and xen-4.6.0-9.el7, which contain patches for XSAs 167-169, are on their way to CentOS 6 and CentOS 7 Virt Sig Xen mirrors, respectively. As a reminder, this is the last security update for xen-4.4. Xen 4.6 for CentOS 6 is already available in centos-virt-xen-testing, and we will be pushing it to the main (mirrors) repository sometime this week....

I've built Xen 4.6.6 with the XSAs released last week, and tagged it so that it shows up in centos-virt-testing. Please test it and let me know if you have any problems. Thanks, -George

On Thu, Jan 21, 2016 at 3:39 PM, Johnny Hughes <johnny at centos.org> wrote: > On 01/21/2016 09:29 AM, Johnny Hughes wrote: >> This is a community SIG .. and xenproject.org does NOT release XSAs for >> 4.2. The goal of Xen4centOS was to use an upstream LTS kernel and >> update those as required to stay on an LTS. Also to do every second >> point release of xen (ie, 4.2, 4.4, 4.6). All so we are longer term >> than upstream, BUT we have supported code from upstrea...

On 02/17/2016 06:30 AM, George Dunlap wrote: <snip> For C6 users: > * If you want to update to xen-46, and also get further updates automatically: > > yum install centos-release-xen-46 Would this be instead (to get latest and always stay one latest): yum remove centos-release-xen44 centos-release-xen46 yum install centos-release-xen (instead of installing

Xen 4.6.3-15 packages for CentOS 6 and CentOS 7 are on their way through the build system. They should show up in centos-virt-testing in a few hours, and in the main mirrors tomorrow morning (God willing). These contain several critical updates; users are encouraged to update as soon as possible. XSA 220 unfortunately had several dependencies on changes included in 4.6.4 and 4.6.5. This

On 06/20/2017 05:06 AM, George Dunlap wrote: > Xen 4.6.3-15 packages for CentOS 6 and CentOS 7 are on their way > through the build system. They should show up in centos-virt-testing > in a few hours, and in the main mirrors tomorrow morning (God > willing). > > These contain several critical updates; users are encouraged to update > as soon as possible. > There are

Hi all, Sorry for running a bit behind on security patch releases for the Xen-44 branch. As of yesterday, package version 4.4.4-28 was released for testing, which includes all relevant XSA patches through XSA-235 here: https://buildlogs.centos.org/centos/6/virt/x86_64/xen-44/ Please test and provide feedback if possible so we can get this package moved to release fairly soon. Currently in the

Hi, that kernel fix will be released on 6.x repo also ? I see it only on 7.x repo kernel-4.9.31-27.el7.x86_64.rpm thanks On 20/06/2017 20:15, Sarah Newman wrote: > On 06/20/2017 05:06 AM, George Dunlap wrote: >> Xen 4.6.3-15 packages for CentOS 6 and CentOS 7 are on their way >> through the build system. They should show up in centos-virt-testing >> in a few hours, and

...uld I send it ? > > > > Matthew Vernon has offered to test my amd64 binaries. I will test the > > i386 packages myself. > > In fact, I have built and tested amd64 binaries. Sorry for the late reply, was on vacation for a week. What's the status of jessie? Most of the XSAs seem to affect oldstable as well. Cheers, Moritz