From 4da4e454682f64448c23a057c2f6adccb4b0e133 Mon Sep 17 00:00:00 2001 From: Ryan O'Hara Date: Wed, 7 Apr 2021 10:14:32 -0500 Subject: [PATCH 1/5] Update to 2.2.2 (#1935590) --- .gitignore | 1 + keepalived.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 75a2df5..7f5d174 100644 --- a/.gitignore +++ b/.gitignore @@ -35,3 +35,4 @@ /keepalived-2.1.5.tar.gz /keepalived-2.2.0.tar.gz /keepalived-2.2.1.tar.gz +/keepalived-2.2.2.tar.gz diff --git a/keepalived.spec b/keepalived.spec index 76d61a4..772066c 100644 --- a/keepalived.spec +++ b/keepalived.spec @@ -9,8 +9,8 @@ Name: keepalived Summary: High Availability monitor built upon LVS, VRRP and service pollers -Version: 2.2.1 -Release: 2%{?dist} +Version: 2.2.2 +Release: 1%{?dist} License: GPLv2+ URL: http://www.keepalived.org/ @@ -103,6 +103,9 @@ mkdir -p %{buildroot}%{_libexecdir}/keepalived %{_mandir}/man8/keepalived.8* %changelog +* Wed Apr 07 2021 Ryan O'Hara - 2.2.2-1 +- Update to 2.2.2 (#1935590) + * Tue Jan 26 2021 Fedora Release Engineering - 2.2.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild diff --git a/sources b/sources index 25ef34b..1754f00 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (keepalived-2.2.1.tar.gz) = 721ac77e641ba53b23b65d278002a7af639c17741405d6bce4fc5f9f069a7f84d2dcae8bf8d08c517326373c113424efdb522cfb31638d23e4ad6c261252ea3c +SHA512 (keepalived-2.2.2.tar.gz) = 05bb589c76faa4d3f734ecb1a3e5ac40af006fe5dce962bcd9617f192e59bb5336a911b148c1530fb864333da87c3d42a6fbf7d0ef074f6a53ce5a71db8ec706 From f0a26611a243745f9663041a47c4d5c6c7f8a08d Mon Sep 17 00:00:00 2001 From: Ryan O'Hara Date: Mon, 12 Apr 2021 13:33:12 -0500 Subject: [PATCH 2/5] Add BuildRequires for file-devel --- keepalived.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/keepalived.spec b/keepalived.spec index 772066c..624d69b 100644 --- a/keepalived.spec +++ b/keepalived.spec @@ -10,7 +10,7 @@ Name: keepalived Summary: High Availability monitor built upon LVS, VRRP and service pollers Version: 2.2.2 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ URL: http://www.keepalived.org/ @@ -36,6 +36,7 @@ BuildRequires: systemd-units BuildRequires: openssl-devel BuildRequires: libnl3-devel BuildRequires: libnfnetlink-devel +BuildRequires: file-devel BuildRequires: make %description @@ -61,7 +62,7 @@ infrastructures. %{?with_profile:--enable-profile} \ %{!?with_vrrp:--disable-vrrp} \ %{?with_snmp:--enable-snmp --enable-snmp-rfc} \ - %{?with_nftables:--enable-nftables --disable-iptables --disable-ipset} \ + %{?with_nftables:--enable-nftables --disable-iptables} \ %{?with_sha1:--enable-sha1} \ --with-init=systemd %{__make} %{?_smp_mflags} STRIP=/bin/true @@ -103,6 +104,9 @@ mkdir -p %{buildroot}%{_libexecdir}/keepalived %{_mandir}/man8/keepalived.8* %changelog +* Mon Apr 12 2021 Ryan O'Hara - 2.2.2-2 +- Add BuildRequires for file-devel + * Wed Apr 07 2021 Ryan O'Hara - 2.2.2-1 - Update to 2.2.2 (#1935590) From 97d33f6661e50372d480a8658b42f72e19647906 Mon Sep 17 00:00:00 2001 From: Ryan O'Hara Date: Tue, 13 Apr 2021 11:50:49 -0500 Subject: [PATCH 3/5] Fix rhbz# in changelog --- keepalived.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/keepalived.spec b/keepalived.spec index 624d69b..97305a2 100644 --- a/keepalived.spec +++ b/keepalived.spec @@ -108,7 +108,7 @@ mkdir -p %{buildroot}%{_libexecdir}/keepalived - Add BuildRequires for file-devel * Wed Apr 07 2021 Ryan O'Hara - 2.2.2-1 -- Update to 2.2.2 (#1935590) +- Update to 2.2.2 (#1935990) * Tue Jan 26 2021 Fedora Release Engineering - 2.2.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 2646ddf12481d07589bb11fe1e51a79e19038c4e Mon Sep 17 00:00:00 2001 From: Ryan O'Hara Date: Tue, 14 Dec 2021 10:40:37 -0600 Subject: [PATCH 4/5] Update to 2.2.4 (#1996274) --- .gitignore | 1 + keepalived.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 7f5d174..41253a0 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ /keepalived-2.2.0.tar.gz /keepalived-2.2.1.tar.gz /keepalived-2.2.2.tar.gz +/keepalived-2.2.4.tar.gz diff --git a/keepalived.spec b/keepalived.spec index 97305a2..f66e598 100644 --- a/keepalived.spec +++ b/keepalived.spec @@ -9,8 +9,8 @@ Name: keepalived Summary: High Availability monitor built upon LVS, VRRP and service pollers -Version: 2.2.2 -Release: 2%{?dist} +Version: 2.2.4 +Release: 1%{?dist} License: GPLv2+ URL: http://www.keepalived.org/ @@ -104,6 +104,9 @@ mkdir -p %{buildroot}%{_libexecdir}/keepalived %{_mandir}/man8/keepalived.8* %changelog +* Tue Dec 14 2021 Ryan O'Hara - 2.2.4-1 +- Update to 2.2.4 (#1996274) + * Mon Apr 12 2021 Ryan O'Hara - 2.2.2-2 - Add BuildRequires for file-devel diff --git a/sources b/sources index 1754f00..1ab012a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (keepalived-2.2.2.tar.gz) = 05bb589c76faa4d3f734ecb1a3e5ac40af006fe5dce962bcd9617f192e59bb5336a911b148c1530fb864333da87c3d42a6fbf7d0ef074f6a53ce5a71db8ec706 +SHA512 (keepalived-2.2.4.tar.gz) = b8b0f3e7092b7b7093a9927259928076ee95ed176dd26b3a5c38e8c0dc7b83468433944905618dbc9e4b73b81b0cd3f16c2db4234ed4fcdf30f4fc0e532f9422 From c209254ea60da04ba1ed89ea1703e95144efabb1 Mon Sep 17 00:00:00 2001 From: Ryan O'Hara Date: Tue, 14 Dec 2021 10:42:47 -0600 Subject: [PATCH 5/5] Fix dbus policy (#2027158, CVE-2021-442255) --- bz2027158-fix-dbus-policy.patch | 41 +++++++++++++++++++++++++++++++++ keepalived.spec | 8 ++++++- 2 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 bz2027158-fix-dbus-policy.patch diff --git a/bz2027158-fix-dbus-policy.patch b/bz2027158-fix-dbus-policy.patch new file mode 100644 index 0000000..29d1fc5 --- /dev/null +++ b/bz2027158-fix-dbus-policy.patch @@ -0,0 +1,41 @@ +From 7977fec0be89ae6fe87405b3f8da2f0b5e415e3d Mon Sep 17 00:00:00 2001 +From: Vincent Bernat +Date: Tue, 23 Nov 2021 06:50:59 +0100 +Subject: [PATCH] dbus: fix policy to not be overly broad + +The DBus policy did not restrict the message destination, allowing any +user to inspect and manipulate any property. + +Signed-off-by: Vincent Bernat +--- + keepalived/dbus/org.keepalived.Vrrp1.conf | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/keepalived/dbus/org.keepalived.Vrrp1.conf b/keepalived/dbus/org.keepalived.Vrrp1.conf +index 2b78a575..b5ced608 100644 +--- a/keepalived/dbus/org.keepalived.Vrrp1.conf ++++ b/keepalived/dbus/org.keepalived.Vrrp1.conf +@@ -3,12 +3,15 @@ + "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd"> + + +- +- ++ ++ + + +- +- +- ++ ++ ++ + + +-- +2.33.1 + diff --git a/keepalived.spec b/keepalived.spec index f66e598..1b5e89d 100644 --- a/keepalived.spec +++ b/keepalived.spec @@ -10,13 +10,15 @@ Name: keepalived Summary: High Availability monitor built upon LVS, VRRP and service pollers Version: 2.2.4 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ URL: http://www.keepalived.org/ Source0: http://www.keepalived.org/software/keepalived-%{version}.tar.gz Source1: keepalived.service +Patch1: bz2027158-fix-dbus-policy.patch + Requires(post): systemd Requires(preun): systemd Requires(postun): systemd @@ -55,6 +57,7 @@ infrastructures. %prep %setup -q +%patch1 -p1 %build %configure \ @@ -104,6 +107,9 @@ mkdir -p %{buildroot}%{_libexecdir}/keepalived %{_mandir}/man8/keepalived.8* %changelog +* Tue Dec 14 2021 Ryan O'Hara - 2.2.4-2 +- Fix dbus policy (#2027158, CVE-2021-442255) + * Tue Dec 14 2021 Ryan O'Hara - 2.2.4-1 - Update to 2.2.4 (#1996274)