similar to: XSAs 170 and 154, repository layouts, and centos-release-xen 8-1

On Sat, Feb 20, 2016 at 9:24 PM, Sarah Newman <srn at prgmr.com> wrote: > On 02/17/2016 04:30 AM, George Dunlap wrote: >> I have the following packages going through the CBS: >> * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 >> * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 >> * A CentOS 6 xen-4.4.3-11, with XSAs 170 >> >> All these should show up in

On 02/17/2016 04:30 AM, George Dunlap wrote: > I have the following packages going through the CBS: > * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 > * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 > * A CentOS 6 xen-4.4.3-11, with XSAs 170 > > All these should show up in mirrors hopefully sometime later today. > As usual, please report any problems here. Domains using the

On 23/02/16 15:04, George Dunlap wrote: > On Sat, Feb 20, 2016 at 9:24 PM, Sarah Newman <srn at prgmr.com> wrote: >> On 02/17/2016 04:30 AM, George Dunlap wrote: >>> I have the following packages going through the CBS: >>> * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 >>> * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 >>> * A CentOS 6

On Wed, Feb 17, 2016 at 12:30 PM, George Dunlap <dunlapg at umich.edu> wrote: > I have the following packages going through the CBS: > * A CentOS 7 xen-4.6.1-2, with XSAs 170 and 154 > * A CentOS 6 xen-4.6.1-2, with XSAs 170 and 154 > * A CentOS 6 xen-4.4.3-11, with XSAs 170 > > All these should show up in mirrors hopefully sometime later today. > As usual, please report

On 02/17/2016 06:30 AM, George Dunlap wrote: <snip> For C6 users: > * If you want to update to xen-46, and also get further updates automatically: > > yum install centos-release-xen-46 Would this be instead (to get latest and always stay one latest): yum remove centos-release-xen44 centos-release-xen46 yum install centos-release-xen (instead of installing

XSA 169 is out, but is low-priority and has a work-around, so I'm going to batch it together with XSAs 167-168 and release a new 4.4.3 package when the embargo is lifted next Wednesday. This will be the last XSA update for the 4.4.3 packages. Today or tomorrow I will push the Xen 4.6.0 packages to buildlogs for testing; and sometime after the final 4.4.3 packages are released, I will push

This is a community SIG .. and xenproject.org does NOT release XSAs for 4.2. The goal of Xen4centOS was to use an upstream LTS kernel and update those as required to stay on an LTS. Also to do every second point release of xen (ie, 4.2, 4.4, 4.6). All so we are longer term than upstream, BUT we have supported code from upstream. So, the goal is to use supported code for the longest amount of

?My .02 is to stay the course. ?As a server admin, I want to be able to type things like: yum upgrade php ????not yum upgrade php55-epel-rpmforge-fancy-package Having to remember all the idiosyncrasies of a system is what causes some type of major failure in the future whenever (1) you forget something or (2) someone else has to pick up the box to adminster. -- ?Craig Thompson,

Just a heads-up: A Xen package with XSAs through 163 is on its way through the build system. I'll send an announcement when I've tagged it as ready to be propagated to the mirrors. As with the last XSA update, it will depend on having manually updated to the new Virt SIG repository layout. If you haven't already please run the following in preparation: yum install

On Thu, Jan 21, 2016 at 1:28 PM, Phill Bandelow <phill at onapp.com> wrote: > Well when the last upgrade 4.2 > 4.4 went live and XM was disabled by > default it took many hosts down without warning. 4.4 > 4.6 may cause the > same issues. It's a dangerous upgrade for sure. Why can't 4.4 be LTS for C6? > as it's the last build with XM. Any XSA patches should not

Just a heads-up -- 4.6.3-2, for both CentOS 7 and CentOS 6, are making their way through the build system now and should be in the mirrors hopefully sometime later this afternoon. These contain patches for XSAs 185-188, one of which is a fairly critical update, so please update as soon as they're available. -George

Dear Security Team, I have prepared a new upload addressing a number of open security issues in Xen. Due to the complexity of the patches that address XSA-273 [0] the packages have been built from upstream's staging-4.8 / staging-4.10 branch again as recommended in that advisory. Commits on those branches are restricted to those that address the following XSAs (cf. [1]): - XSA-273

Salvatore Bonaccorso writes ("Re: Updated Xen packages for XSA 216..225"): > On Tue, Jul 11, 2017 at 11:34:38PM +0200, Moritz Muehlenhoff wrote: > > On Mon, Jul 03, 2017 at 12:33:54PM +0100, Ian Jackson wrote: > > > Moritz M?hlenhoff writes ("Re: Updated Xen packages for XSA 216..225"): > > > > Sorry for the late reply, was on vacation for a week.

Xen 4.4.4 along with kernel 4.9.44 containing patches for XSAs (226 - 230) from August 15th are now available in centos-virt-testing. If possible, please test and provide feedback here so we can move these to release soon. XSA-228 did not affect Xen 4.4 XSA-229 only applies to the kernel XSA-235 disclosed today only affects ARM and isn't going to be added to these packages. Thanks. --

Xen 4.6.6-8 has been tagged in virt-testing. It contains XSAs 248-251, as well as an additional fix to XSA 240. Please test it if you get a chance and report any bugs; I'll probably push it to mirrors tomorrow if I don't hear anything. Peace, -George

On Mon, Jul 03, 2017 at 12:33:54PM +0100, Ian Jackson wrote: > Moritz M?hlenhoff writes ("Re: Updated Xen packages for XSA 216..225"): > > Sorry for the late reply, was on vacation for a week. What's the status > > of jessie? Most of the XSAs seem to affect oldstable as well. > > Sorry, I forgot about them... > > I will see what I can do. Did you look

Kevin has been rolling back the security updates to the 4.4 branch. He has been working with some of the other distros (debian for sure, and some others on the xen security list). I think it is his intention to continue this for as long as he is able to. (Kevin, chime in if you have a schedule lifetime or EOL in mind) As long as Kevin (or anyone else) maintains the tree, I am happy to build

Xen 4.6.3-15 packages for CentOS 6 and CentOS 7 are on their way through the build system. They should show up in centos-virt-testing in a few hours, and in the main mirrors tomorrow morning (God willing). These contain several critical updates; users are encouraged to update as soon as possible. XSA 220 unfortunately had several dependencies on changes included in 4.6.4 and 4.6.5. This

On Tue, Jun 20, 2017 at 02:06:17PM +0100, Ian Jackson wrote: > Ian Jackson writes ("Updated Xen packages for XSA 216..225"): > > FYI I will have an upload ready RSN. Where should I send it ? > > > > Matthew Vernon has offered to test my amd64 binaries. I will test the > > i386 packages myself. > > In fact, I have built and tested amd64 binaries.

Hi, that kernel fix will be released on 6.x repo also ? I see it only on 7.x repo kernel-4.9.31-27.el7.x86_64.rpm thanks On 20/06/2017 20:15, Sarah Newman wrote: > On 06/20/2017 05:06 AM, George Dunlap wrote: >> Xen 4.6.3-15 packages for CentOS 6 and CentOS 7 are on their way >> through the build system. They should show up in centos-virt-testing >> in a few hours, and