Re: N/A Re: [alerts-security] [DLA 20-1] munin security update

2014-08-09 Thread Matus UHLAR - fantomas
On 08/07/2014 04:48 PM, Holger Levsen wrote: Package: munin Version: 1.4.5-3+deb6u1 CVE ID : CVE-2012-3512 CVE-2013-6048 CVE-2013-6359 [ Christoph Biedl ] * munin-node: more secure state file handling, introducing a new plugin state directory root, owned by uid 0. Then

Re: [DLA 20-1] munin security update

2014-08-08 Thread Holger Levsen
Hi Vincent, thanks for your feedback! On Freitag, 8. August 2014, Vincent Bernat wrote: > >>plugins will use /var/lib/munin-node/plugin-state/$uid/$some_file now > >>- please report plugins that are still using > >>/var/lib/munin/plugin-state/ - as those might pose a security risk! >

Re: [DLA 20-1] munin security update

2014-08-08 Thread Vincent Bernat
❦ 7 août 2014 16:52 +0200, Frank Baalbergen  : > On 08/07/2014 04:48 PM, Holger Levsen wrote: >> * plugins: use runtime $ENV{MUNIN_PLUGSTATE}. So all properly written >>plugins will use /var/lib/munin-node/plugin-state/$uid/$some_file now - >>please report plugins that are still using /

N/A Re: [alerts-security] [DLA 20-1] munin security update

2014-08-07 Thread Frank Baalbergen
On 08/07/2014 04:48 PM, Holger Levsen wrote: Package: munin Version: 1.4.5-3+deb6u1 CVE ID : CVE-2012-3512 CVE-2013-6048 CVE-2013-6359 [ Christoph Biedl ] * munin-node: more secure state file handling, introducing a new plugin state directory root, owned by uid 0. Then