Bash security update published by Redhat

[clm]

Hello,

Are you working on implementing the new bash security update ?

https://access.redhat.com/solutions/1207723

Seems quite serious, any ETA on this ?

http://www.webhostingtalk.com/showthread.php?p=9245167

Thanks !

[sqh]

Wondered the same, thanks for asking Richard.

- Scott

[iseletsk]

It is being pushed into all the channels right now. Should be ready within next 15-45 minutes.

[sergey]

There is no any updates yet. Do you have some ETA?

[iseletsk]

Make sure you did: yum clean all
All the packages are in the channel.

[clm]

Thanks !

Is there a risk running ldconfig instead of rebooting ?

[rodrigomf]

Hi there:

I just did exactly that but got this:

yum update bash
Loaded plugins: priorities, protectbase, rhnplugin, security
27 packages excluded due to repository priority protections
0 packages excluded due to repository protections
Setting up Update Process
No Packages marked for Update

Any clues?

[david]

Igor, will you guys be waiting for upstream for the next patch or will you guys patch it yourselves?

https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c23

https://access.redhat.com/security/cve/CVE-2014-7169

Might not be as bad as I thought, so perhaps its worth waiting for upstream patch.

http://www.openwall.com/lists/oss-security/2014/09/24/40

[david]

bitlab:
try:

yum clean all

yum update bash

It also seems youre using yum priorities plugin. Perhaps youre holding bash back by having higher priority for some other repo?
Check priority in your /etc/yum.repos.d/ files and make sure cloudlinux.repo has the highest (lowest value) priority - that is: priority=1

[rodrigomf]

Yeah, figured it out, thank you very much!

[tommy]

Is the updated fix far away Igor?

[sqh]

CloudLinux pushed out the first bash update, but now there is a second update available. My non-CloudLinux boxes got the update directly from the CentOS repo... just waiting for CloudLinux to catch up.

- Scott

[tommy]

Update seem to be available now.

[accounts]

Until the fix comes, if you use mod_security add the rules posted here: https://access.redhat.com/articles/1212303

[david]

afaik it shouldnt print out those error messages kernow.

Check bottom https://access.redhat.com/articles/1212303 for the outputs when not affected.
Perhaps theres a difference of output from redhat and debian?