similar to: CentOS 6 Xen: XSAs 167-169, update to Xen 4.6

I have the following packages going through the CBS: * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 * A CentOS 6 xen-4.4.3-11, with XSAs 170 All these should show up in mirrors hopefully sometime later today. As usual, please report any problems here. Xen 4.4 only has XSA 170 because at the time the embargo was lifted, I didn't have a suitable

On Wed, Feb 17, 2016 at 12:30 PM, George Dunlap <dunlapg at umich.edu> wrote: > I have the following packages going through the CBS: > * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 > * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 > * A CentOS 6 xen-4.4.3-11, with XSAs 170 > > All these should show up in mirrors hopefully sometime later today. > As usual, please report

Just a heads-up: A Xen package with XSAs through 163 is on its way through the build system. I'll send an announcement when I've tagged it as ready to be propagated to the mirrors. As with the last XSA update, it will depend on having manually updated to the new Virt SIG repository layout. If you haven't already please run the following in preparation: yum install

On Sat, Feb 20, 2016 at 9:24 PM, Sarah Newman <srn at prgmr.com> wrote: > On 02/17/2016 04:30 AM, George Dunlap wrote: >> I have the following packages going through the CBS: >> * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 >> * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 >> * A CentOS 6 xen-4.4.3-11, with XSAs 170 >> >> All these should show up in

Dear Security Team, I have prepared a new upload addressing a number of open security issues in Xen. Due to the complexity of the patches that address XSA-273 [0] the packages have been built from upstream's staging-4.8 / staging-4.10 branch again as recommended in that advisory. Commits on those branches are restricted to those that address the following XSAs (cf. [1]): - XSA-273

xen-4.4.3-9 and kernel-3.18.21-17 (unsigneg) are now on buildlogs.centos.org, and signed packages should be making their way through the mirror system in the near future. Updated package sources can be found in the virt sig area on CentOS: https://github.com/CentOS-virt7/xen https://github.com/CentOS-virt7/xen-kernel The packages contain updates for XSAs 155, 157, 164, 165, and 166 (released

Just to let people know what's going on: The embargo for XSA-135 lifted today at 1400 UTC. The embargoes for XSAs 134 and 136 lift tomorrow at 1200 UTC. XSA-135 only affects guests which have been assigned a PCNET emulated NIC, which is not the default; as such, it doesn't seem terribly urgent to push the fix today. So rather than push one fix today and another tomorrow, our plan is

xen-4.4.3-10.el6 and xen-4.6.0-9.el7, which contain patches for XSAs 167-169, are on their way to CentOS 6 and CentOS 7 Virt Sig Xen mirrors, respectively. As a reminder, this is the last security update for xen-4.4. Xen 4.6 for CentOS 6 is already available in centos-virt-xen-testing, and we will be pushing it to the main (mirrors) repository sometime this week. Peace, -George

Salvatore Bonaccorso writes ("Re: Updated Xen packages for XSA 216..225"): > On Tue, Jul 11, 2017 at 11:34:38PM +0200, Moritz Muehlenhoff wrote: > > On Mon, Jul 03, 2017 at 12:33:54PM +0100, Ian Jackson wrote: > > > Moritz M?hlenhoff writes ("Re: Updated Xen packages for XSA 216..225"): > > > > Sorry for the late reply, was on vacation for a week.

Xen 4.4.4 along with kernel 4.9.44 containing patches for XSAs (226 - 230) from August 15th are now available in centos-virt-testing. If possible, please test and provide feedback here so we can move these to release soon. XSA-228 did not affect Xen 4.4 XSA-229 only applies to the kernel XSA-235 disclosed today only affects ARM and isn't going to be added to these packages. Thanks. --

Hi, that kernel fix will be released on 6.x repo also ? I see it only on 7.x repo kernel-4.9.31-27.el7.x86_64.rpm thanks On 20/06/2017 20:15, Sarah Newman wrote: > On 06/20/2017 05:06 AM, George Dunlap wrote: >> Xen 4.6.3-15 packages for CentOS 6 and CentOS 7 are on their way >> through the build system. They should show up in centos-virt-testing >> in a few hours, and

On Mon, Jul 03, 2017 at 12:33:54PM +0100, Ian Jackson wrote: > Moritz M?hlenhoff writes ("Re: Updated Xen packages for XSA 216..225"): > > Sorry for the late reply, was on vacation for a week. What's the status > > of jessie? Most of the XSAs seem to affect oldstable as well. > > Sorry, I forgot about them... > > I will see what I can do. Did you look

Kevin has been rolling back the security updates to the 4.4 branch. He has been working with some of the other distros (debian for sure, and some others on the xen security list). I think it is his intention to continue this for as long as he is able to. (Kevin, chime in if you have a schedule lifetime or EOL in mind) As long as Kevin (or anyone else) maintains the tree, I am happy to build

On Tue, Jun 20, 2017 at 02:06:17PM +0100, Ian Jackson wrote: > Ian Jackson writes ("Updated Xen packages for XSA 216..225"): > > FYI I will have an upload ready RSN. Where should I send it ? > > > > Matthew Vernon has offered to test my amd64 binaries. I will test the > > i386 packages myself. > > In fact, I have built and tested amd64 binaries.

Xen 4.6.6-8 has been tagged in virt-testing. It contains XSAs 248-251, as well as an additional fix to XSA 240. Please test it if you get a chance and report any bugs; I'll probably push it to mirrors tomorrow if I don't hear anything. Peace, -George

Hi all, Sorry for running a bit behind on security patch releases for the Xen-44 branch. As of yesterday, package version 4.4.4-28 was released for testing, which includes all relevant XSA patches through XSA-235 here: https://buildlogs.centos.org/centos/6/virt/x86_64/xen-44/ Please test and provide feedback if possible so we can get this package moved to release fairly soon. Currently in the

On 23/02/16 15:04, George Dunlap wrote: > On Sat, Feb 20, 2016 at 9:24 PM, Sarah Newman <srn at prgmr.com> wrote: >> On 02/17/2016 04:30 AM, George Dunlap wrote: >>> I have the following packages going through the CBS: >>> * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 >>> * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 >>> * A CentOS 6

Just a heads-up -- 4.6.3-2, for both CentOS 7 and CentOS 6, are making their way through the build system now and should be in the mirrors hopefully sometime later this afternoon. These contain patches for XSAs 185-188, one of which is a fairly critical update, so please update as soon as they're available. -George

Xen 4.6.3-15 packages for CentOS 6 and CentOS 7 are on their way through the build system. They should show up in centos-virt-testing in a few hours, and in the main mirrors tomorrow morning (God willing). These contain several critical updates; users are encouraged to update as soon as possible. XSA 220 unfortunately had several dependencies on changes included in 4.6.4 and 4.6.5. This

On Mon, Aug 07, 2017 at 01:15:56PM +0200, Moritz Muehlenhoff wrote: > On Mon, Jul 17, 2017 at 03:58:20PM +0100, Ian Jackson wrote: > > Salvatore Bonaccorso writes ("Re: Updated Xen packages for XSA 216..225"): > > > On Tue, Jul 11, 2017 at 11:34:38PM +0200, Moritz Muehlenhoff wrote: > > > > On Mon, Jul 03, 2017 at 12:33:54PM +0100, Ian Jackson wrote: >