From aa019cd0fa0e5984cd59c85894bce6cdbdc213ea Mon Sep 17 00:00:00 2001 From: Ryan O'Hara Date: Sat, 14 Aug 2021 16:33:10 -0500 Subject: [PATCH 1/3] Update to 2.2.3 (#1993601) --- .gitignore | 1 + bz1987620-fix-build-errors.patch | 32 -------------------------------- keepalived.spec | 10 +++++----- sources | 2 +- 4 files changed, 7 insertions(+), 38 deletions(-) delete mode 100644 bz1987620-fix-build-errors.patch diff --git a/.gitignore b/.gitignore index 7f5d174..913af37 100644 --- a/.gitignore +++ b/.gitignore @@ -36,3 +36,4 @@ /keepalived-2.2.0.tar.gz /keepalived-2.2.1.tar.gz /keepalived-2.2.2.tar.gz +/keepalived-2.2.3.tar.gz diff --git a/bz1987620-fix-build-errors.patch b/bz1987620-fix-build-errors.patch deleted file mode 100644 index ee4a31b..0000000 --- a/bz1987620-fix-build-errors.patch +++ /dev/null @@ -1,32 +0,0 @@ -From d9c99ffe43d9848579a472c7c5ec5515e6599cb9 Mon Sep 17 00:00:00 2001 -From: Ryan O'Hara -Date: Mon, 7 Jun 2021 16:58:23 -0500 -Subject: [PATCH] Fix build errors - ---- - keepalived/core/layer4.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/keepalived/core/layer4.c b/keepalived/core/layer4.c -index d2cc971a..fdca0491 100644 ---- a/keepalived/core/layer4.c -+++ b/keepalived/core/layer4.c -@@ -27,13 +27,14 @@ - #include - #include - #include -+#include -+#include - #include - #include - #ifdef ERRQUEUE_NEEDS_SYS_TIME - #include - #endif - #include --#include - - #include "layer4.h" - #include "logger.h" --- -2.31.1 - diff --git a/keepalived.spec b/keepalived.spec index 155f221..77d63e5 100644 --- a/keepalived.spec +++ b/keepalived.spec @@ -9,16 +9,14 @@ Name: keepalived Summary: High Availability monitor built upon LVS, VRRP and service pollers -Version: 2.2.2 -Release: 5%{?dist} +Version: 2.2.3 +Release: 1%{?dist} License: GPLv2+ URL: http://www.keepalived.org/ Source0: http://www.keepalived.org/software/keepalived-%{version}.tar.gz Source1: keepalived.service -Patch1: bz1987620-fix-build-errors.patch - Requires(post): systemd Requires(preun): systemd Requires(postun): systemd @@ -58,7 +56,6 @@ infrastructures. %prep %setup -q -%patch1 -p1 %build %configure \ @@ -108,6 +105,9 @@ mkdir -p %{buildroot}%{_libexecdir}/keepalived %{_mandir}/man8/keepalived.8* %changelog +* Sat Aug 14 2021 Ryan O'Hara - 2.2.3-1 +- Update to 2.2.3 (#1993601) + * Tue Aug 03 2021 Ryan O'Hara - 2.2.2-5 - Add systemd notify support diff --git a/sources b/sources index 1754f00..7328974 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (keepalived-2.2.2.tar.gz) = 05bb589c76faa4d3f734ecb1a3e5ac40af006fe5dce962bcd9617f192e59bb5336a911b148c1530fb864333da87c3d42a6fbf7d0ef074f6a53ce5a71db8ec706 +SHA512 (keepalived-2.2.3.tar.gz) = 79c884d73326c0ab4eb1cd9335b87b11f145549a8aa97da782b3b3371d361504b4c4a34a430d13fbbd2ae11c65e4980b283527e8327db142dba34c00fda25ccd From 8eebd02992fc75b98f6462353d32d3f26672eb26 Mon Sep 17 00:00:00 2001 From: Ryan O'Hara Date: Mon, 23 Aug 2021 09:14:11 -0500 Subject: [PATCH 2/3] Update to 2.2.4 (#1996274) --- .gitignore | 1 + keepalived.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 913af37..3d0ed91 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ /keepalived-2.2.1.tar.gz /keepalived-2.2.2.tar.gz /keepalived-2.2.3.tar.gz +/keepalived-2.2.4.tar.gz diff --git a/keepalived.spec b/keepalived.spec index 77d63e5..35786bf 100644 --- a/keepalived.spec +++ b/keepalived.spec @@ -9,7 +9,7 @@ Name: keepalived Summary: High Availability monitor built upon LVS, VRRP and service pollers -Version: 2.2.3 +Version: 2.2.4 Release: 1%{?dist} License: GPLv2+ URL: http://www.keepalived.org/ @@ -105,6 +105,9 @@ mkdir -p %{buildroot}%{_libexecdir}/keepalived %{_mandir}/man8/keepalived.8* %changelog +* Mon Aug 23 2021 Ryan O'Hara - 2.2.4-1 +- Update to 2.2.4 (#1996274) + * Sat Aug 14 2021 Ryan O'Hara - 2.2.3-1 - Update to 2.2.3 (#1993601) diff --git a/sources b/sources index 7328974..1ab012a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (keepalived-2.2.3.tar.gz) = 79c884d73326c0ab4eb1cd9335b87b11f145549a8aa97da782b3b3371d361504b4c4a34a430d13fbbd2ae11c65e4980b283527e8327db142dba34c00fda25ccd +SHA512 (keepalived-2.2.4.tar.gz) = b8b0f3e7092b7b7093a9927259928076ee95ed176dd26b3a5c38e8c0dc7b83468433944905618dbc9e4b73b81b0cd3f16c2db4234ed4fcdf30f4fc0e532f9422 From 47be800f25277cda975f5854e03f271ca27ec9ac Mon Sep 17 00:00:00 2001 From: Ryan O'Hara Date: Tue, 14 Dec 2021 10:28:57 -0600 Subject: [PATCH 3/3] Fix dbus policy (#2027158, CVE-2021-44225) --- bz2027158-fix-dbus-policy.patch | 41 +++++++++++++++++++++++++++++++++ keepalived.spec | 8 ++++++- 2 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 bz2027158-fix-dbus-policy.patch diff --git a/bz2027158-fix-dbus-policy.patch b/bz2027158-fix-dbus-policy.patch new file mode 100644 index 0000000..29d1fc5 --- /dev/null +++ b/bz2027158-fix-dbus-policy.patch @@ -0,0 +1,41 @@ +From 7977fec0be89ae6fe87405b3f8da2f0b5e415e3d Mon Sep 17 00:00:00 2001 +From: Vincent Bernat +Date: Tue, 23 Nov 2021 06:50:59 +0100 +Subject: [PATCH] dbus: fix policy to not be overly broad + +The DBus policy did not restrict the message destination, allowing any +user to inspect and manipulate any property. + +Signed-off-by: Vincent Bernat +--- + keepalived/dbus/org.keepalived.Vrrp1.conf | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/keepalived/dbus/org.keepalived.Vrrp1.conf b/keepalived/dbus/org.keepalived.Vrrp1.conf +index 2b78a575..b5ced608 100644 +--- a/keepalived/dbus/org.keepalived.Vrrp1.conf ++++ b/keepalived/dbus/org.keepalived.Vrrp1.conf +@@ -3,12 +3,15 @@ + "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd"> + + +- +- ++ ++ + + +- +- +- ++ ++ ++ + + +-- +2.33.1 + diff --git a/keepalived.spec b/keepalived.spec index 35786bf..9f44591 100644 --- a/keepalived.spec +++ b/keepalived.spec @@ -10,13 +10,15 @@ Name: keepalived Summary: High Availability monitor built upon LVS, VRRP and service pollers Version: 2.2.4 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ URL: http://www.keepalived.org/ Source0: http://www.keepalived.org/software/keepalived-%{version}.tar.gz Source1: keepalived.service +Patch1: bz2027158-fix-dbus-policy.patch + Requires(post): systemd Requires(preun): systemd Requires(postun): systemd @@ -56,6 +58,7 @@ infrastructures. %prep %setup -q +%patch1 -p1 %build %configure \ @@ -105,6 +108,9 @@ mkdir -p %{buildroot}%{_libexecdir}/keepalived %{_mandir}/man8/keepalived.8* %changelog +* Tue Dec 14 2021 Ryan O'Hara - 2.2.4-2 +- Fix dbus policy (#2027158, CVE-2021-44225) + * Mon Aug 23 2021 Ryan O'Hara - 2.2.4-1 - Update to 2.2.4 (#1996274)