From c6c37d716cfe80f6b94d97597d4f2ba1022f0789c4f4f8f6cf3b88af526d386d Mon Sep 17 00:00:00 2001 From: OBS User buildservice-autocommit Date: Fri, 4 Mar 2011 13:12:38 +0000 Subject: [PATCH 1/5] Updating link to change in openSUSE:Factory/subversion revision 76.0 OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm:svn/subversion?expand=0&rev=29ec06c4d1a803bfaf5e070034768661 --- subversion.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/subversion.spec b/subversion.spec index bd57cbd..c44f2c7 100644 --- a/subversion.spec +++ b/subversion.spec @@ -1,5 +1,5 @@ # -# spec file for package subversion (Version 1.6.15) +# spec file for package subversion # # Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany. # Copyright (c) 2009-2010 Pascal Bleser From 65bc75bd992c2086abd2017cad69eab7aa4a2853cddb5052e1fee78842aa8cbe Mon Sep 17 00:00:00 2001 From: Dirk Mueller Date: Fri, 22 Apr 2011 15:34:06 +0000 Subject: [PATCH 2/5] Accepting request 68082 from home:psmt:branches:devel:tools:scm:svn OBS-URL: https://build.opensuse.org/request/show/68082 OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm:svn/subversion?expand=0&rev=45 --- subversion.changes | 5 +++++ subversion.rcsvnserve | 30 +++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-) diff --git a/subversion.changes b/subversion.changes index 1128681..004fef3 100644 --- a/subversion.changes +++ b/subversion.changes @@ -1,3 +1,8 @@ +------------------------------------------------------------------- +Thu Apr 21 15:57:51 CEST 2011 - pth@suse.de + +- Use getent to check for existance of user and group (bnc#688968). + ------------------------------------------------------------------- Thu Feb 24 11:24:33 UTC 2011 - stsp@elego.de diff --git a/subversion.rcsvnserve b/subversion.rcsvnserve index 0a0d042..36a22bc 100644 --- a/subversion.rcsvnserve +++ b/subversion.rcsvnserve @@ -1,5 +1,5 @@ #! /bin/sh -# Copyright (c) 1995-2002 SuSE Linux AG, Nuernberg, Germany. +# Copyright (c) 1995-20011 SuSE Linux AG, Nuernberg, Germany. # All rights reserved. # # /etc/init.d/svnserve @@ -96,17 +96,25 @@ case "$1" in echo -n "Starting svnserve " ## Start daemon with startproc(8). If this fails ## the return value is set appropriately by startproc. - if test -z "$SVNSERVE_USERID" || ! (/usr/bin/id $SVNSERVE_USERID &>/dev/null) \ + UID_ENT="$(/usr/bin/getent passwd $SVNSERVE_USERID)" + GID_ENT="$(/usr/bin/getent group $SVNSERVE_GROUPID)" - test -z "$SVNSERVE_GROUPID" || ! (/usr/bin/id $SVNSERVE_GROUPID &>/dev/null); - then - echo "User $SVNSERVE_USERID does not exist." - echo "Please check $SVNSERVE_CONFIG before starting this service." - rc_failed - else - startproc -u "$SVNSERVE_USERID" -g "$SVNSERVE_GROUPID" -e $SVNSERVE_BIN $SVNSERVE_OPTIONS - fi - # Remember status and be verbose + if test -z "$SVNSERVE_USERID" -o -z "$UID_ENT" + then + echo + echo "User $SVNSERVE_USERID does not exist." + echo "Please check $SVNSERVE_CONFIG before starting this service." + rc_failed + elif test -z "$SVNSERVE_GROUPID" -o -z "$GID_ENT" + then + echo + echo "Group $SVNSERVE_GROUPID does not exist." + echo "Please check $SVNSERVE_CONFIG before starting this service." + rc_failed + else + startproc -u "$SVNSERVE_USERID" -g "$SVNSERVE_GROUPID" -e $SVNSERVE_BIN $SVNSERVE_OPTIONS + fi + # Remember status and be verbose rc_status -v ;; stop) From 1caa7ecc8620e6e9e827acc4f1d3b445f2213b2b18456736f7a2b0d7b8b06f70 Mon Sep 17 00:00:00 2001 From: Dirk Mueller Date: Tue, 10 May 2011 14:23:57 +0000 Subject: [PATCH 3/5] - update to 1.6.16 (bnc#676949): OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm:svn/subversion?expand=0&rev=46 --- subversion.changes | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/subversion.changes b/subversion.changes index 004fef3..8e01b4c 100644 --- a/subversion.changes +++ b/subversion.changes @@ -6,7 +6,7 @@ Thu Apr 21 15:57:51 CEST 2011 - pth@suse.de ------------------------------------------------------------------- Thu Feb 24 11:24:33 UTC 2011 - stsp@elego.de -- update to 1.6.16 (bnc#674949): +- update to 1.6.16 (bnc#676949): User-visible changes: * more improvement to the 'blame -g' memory leak from 1.6.15 (r1041438) * avoid a crash in mod_dav_svn when using locks (r1071239, -307) From 8df5cb567db0d6f0e58adaab72c32c8a82ca9a7c2b4d86e922c91f2525c6b658 Mon Sep 17 00:00:00 2001 From: Stefan Sperling Date: Wed, 1 Jun 2011 21:59:29 +0000 Subject: [PATCH 4/5] - update to 1.6.17 includes security fixes [CVE-2011-1752, CVE-2011-1783, CVE-2011-1921] User-visible changes: * improve checkout speed on Windows (issue #3719) * make 'blame -g' more efficient on with large mergeinfo (r1094692) * avoid some invalid handle exceptions on Windows (r1095654) * preserve log message with a non-zero editor exit (r1072084) * fix FSFS cache performance on 64-bit platforms (r1103665) * make svn cleanup tolerate obstructed directories (r1091881) * fix deadlock in multithreaded servers serving FSFS repositories (r1104093) * detect very occasional corruption and abort commit (issue #3845) * fixed: file externals cause non-inheritable mergeinfo (issue #3843) * fixed: file externals cause mixed-revision working copies (issue #3816) * fix crash in mod_dav_svn with GETs of baselined resources (r1104126) See CVE-2011-1752, and descriptive advisory at http://subversion.apache.org/security/CVE-2011-1752-advisory.txt * fixed: write-through proxy could direcly commit to slave (r917523) * detect a particular corruption condition in FSFS (r1100213) * improve error message when clients refer to unkown revisions (r939000) * bugfixes and optimizations to the DAV mirroring code (r878607) * fixed: locked and deleted file causes tree conflict (issue #3525) * fixed: update touches locked file with svn:keywords property (issue #3471) * fix svnsync handling of directory copyfrom (issue #3641) * fix 'log -g' excessive duplicate output (issue #3650) * fix svnsync copyfrom handling bug with BDB (r1036429) * server-side validation of svn:mergeinfo syntax during commit (issue #3895) * fix remotely triggerable mod_dav_svn DoS See CVE-2011-1783, and descriptive advisory at http://subversion.apache.org/security/CVE-2011-1783-advisory.txt OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm:svn/subversion?expand=0&rev=47 --- subversion-1.6.16.tar.bz2 | 3 --- subversion-1.6.17.tar.bz2 | 3 +++ subversion.changes | 40 +++++++++++++++++++++++++++++++++++++++ subversion.spec | 2 +- 4 files changed, 44 insertions(+), 4 deletions(-) delete mode 100644 subversion-1.6.16.tar.bz2 create mode 100644 subversion-1.6.17.tar.bz2 diff --git a/subversion-1.6.16.tar.bz2 b/subversion-1.6.16.tar.bz2 deleted file mode 100644 index 42a3bb0..0000000 --- a/subversion-1.6.16.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:dce4897d62d0dc29ab03834ed1d66ede95c07702e32a0042f96c24c6f1213386 -size 5509729 diff --git a/subversion-1.6.17.tar.bz2 b/subversion-1.6.17.tar.bz2 new file mode 100644 index 0000000..32251c8 --- /dev/null +++ b/subversion-1.6.17.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:d629c657e171616d30cc0cbddf1011a065770813bfc32f78c6940d09ca868124 +size 5504298 diff --git a/subversion.changes b/subversion.changes index 8e01b4c..837b747 100644 --- a/subversion.changes +++ b/subversion.changes @@ -1,3 +1,43 @@ +------------------------------------------------------------------- +Mon May 30 14:07:41 UTC 2011 - stsp@elego.de + +- update to 1.6.17 + includes security fixes [CVE-2011-1752, CVE-2011-1783, CVE-2011-1921] + User-visible changes: + * improve checkout speed on Windows (issue #3719) + * make 'blame -g' more efficient on with large mergeinfo (r1094692) + * avoid some invalid handle exceptions on Windows (r1095654) + * preserve log message with a non-zero editor exit (r1072084) + * fix FSFS cache performance on 64-bit platforms (r1103665) + * make svn cleanup tolerate obstructed directories (r1091881) + * fix deadlock in multithreaded servers serving FSFS repositories (r1104093) + * detect very occasional corruption and abort commit (issue #3845) + * fixed: file externals cause non-inheritable mergeinfo (issue #3843) + * fixed: file externals cause mixed-revision working copies (issue #3816) + * fix crash in mod_dav_svn with GETs of baselined resources (r1104126) + See CVE-2011-1752, and descriptive advisory at + http://subversion.apache.org/security/CVE-2011-1752-advisory.txt + * fixed: write-through proxy could direcly commit to slave (r917523) + * detect a particular corruption condition in FSFS (r1100213) + * improve error message when clients refer to unkown revisions (r939000) + * bugfixes and optimizations to the DAV mirroring code (r878607) + * fixed: locked and deleted file causes tree conflict (issue #3525) + * fixed: update touches locked file with svn:keywords property (issue #3471) + * fix svnsync handling of directory copyfrom (issue #3641) + * fix 'log -g' excessive duplicate output (issue #3650) + * fix svnsync copyfrom handling bug with BDB (r1036429) + * server-side validation of svn:mergeinfo syntax during commit (issue #3895) + * fix remotely triggerable mod_dav_svn DoS + See CVE-2011-1783, and descriptive advisory at + http://subversion.apache.org/security/CVE-2011-1783-advisory.txt + * fix potential leak of authz-protected file contents + See CVE-2011-1921, and descriptive advisory at + http://subversion.apache.org/security/CVE-2011-1921-advisory.txt + Developer-visible changes: + * fix reporting FS-level post-commit processing errors (r1104098) + * fix JVM recognition on OS X Snow Leopard (10.6) (r1028084) + * allow building on Windows with recent Expat (r1074572) + ------------------------------------------------------------------- Thu Apr 21 15:57:51 CEST 2011 - pth@suse.de diff --git a/subversion.spec b/subversion.spec index c44f2c7..d00df42 100644 --- a/subversion.spec +++ b/subversion.spec @@ -41,7 +41,7 @@ %endif # suse_version > 1030 Name: subversion -Version: 1.6.16 +Version: 1.6.17 Release: 1 # in-tree SWIG version to use for the build: %define swig_version 1.3.36 From 38b0139cb0a34249db3a5644eaa40beeaf4ac456353736d34c724d3c39309b84 Mon Sep 17 00:00:00 2001 From: Dirk Mueller Date: Mon, 6 Jun 2011 11:31:32 +0000 Subject: [PATCH 5/5] - update to 1.6.17 (bnc#698205): OBS-URL: https://build.opensuse.org/package/show/devel:tools:scm:svn/subversion?expand=0&rev=48 --- subversion.changes | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/subversion.changes b/subversion.changes index 837b747..dd45aac 100644 --- a/subversion.changes +++ b/subversion.changes @@ -1,7 +1,7 @@ ------------------------------------------------------------------- Mon May 30 14:07:41 UTC 2011 - stsp@elego.de -- update to 1.6.17 +- update to 1.6.17 (bnc#698205): includes security fixes [CVE-2011-1752, CVE-2011-1783, CVE-2011-1921] User-visible changes: * improve checkout speed on Windows (issue #3719)