Lector de Feeds

Publication date: 12 Feb 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-56326 Description Jinja has a sandbox breakout through an indirect reference to a format method. (CVE-2024-56326) References

• https://bugs.mageia.org/show_bug.cgi?id=33996
• https://lwn.net/Articles/1008460/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56326

SRPMS 9/core

• python-jinja2-3.1.5-1.mga9

Publication date: 12 Feb 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-46303 , CVE-2024-6781 , CVE-2024-6782 , CVE-2024-7008 , CVE-2024-7009 Description link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root. (CVE-2023-46303) Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. (CVE-2024-6781) Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. (CVE-2024-6782) Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting. (CVE-2024-7008) Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database. (CVE-2024-7009) References

• https://bugs.mageia.org/show_bug.cgi?id=33535
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTG4W7NKCI3YSS24S3XTWQKFDUAR6BN3/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46303
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6781
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6782
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7008
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7009

SRPMS 9/core

• calibre-6.17.0-1.1.mga9

Publication date: 12 Feb 2025
Type: bugfix
Affected Mageia releases : 9
Description A missing requires produces a xviewer crash. This update fixes the issue. References

• https://bugs.mageia.org/show_bug.cgi?id=32393

SRPMS 9/core

• xapps-2.6.1-1.1.mga9
• xviewer-3.2.11-1.1.mga9

‎Wild card certificate: duvel

← Older revision Revision as of 06:44, 11 February 2025 Line 32: Line 32:  = Wild card certificate = = Wild card certificate =    −* Generate a CSR file. This creates a new certificate that we will ask Gandi to sign.+== Create ==  +* Generate a CSR file. This creates a new public certificate that we will ask Gandi to sign.     <pre> <pre> Line 47: Line 48:  Then, choose the ''SSL CERTIFICATES'' sidebar, then click on the *.mageia.org certificate. After some minutes/hours, the ''Validation instructions'' section will provide a CNAME record to add to DNS. Add it similar to [https://gitweb.mageia.org/infrastructure/puppet/commit/?id=231e095d4d4dc099589ad27c43e4e9244f78095c this commit]. Wait some minutes/hour (the time it takes for the DNS to get updated). You can follow the process along on the Gandi certificate page. Then, choose the ''SSL CERTIFICATES'' sidebar, then click on the *.mageia.org certificate. After some minutes/hours, the ''Validation instructions'' section will provide a CNAME record to add to DNS. Add it similar to [https://gitweb.mageia.org/infrastructure/puppet/commit/?id=231e095d4d4dc099589ad27c43e4e9244f78095c this commit]. Wait some minutes/hour (the time it takes for the DNS to get updated). You can follow the process along on the Gandi certificate page.    −When it's ready, download the new certificate as well as the Intermediate certificate (in case it changed from the last year). Backup the current certificate files by copying them into a directory based on the year they were requested, in case a reversion is needed. Add the main    on neru and sucuk in '''/etc/ssl/wildcard.mageia.org.crt'''. Store the intermediate certificate in /etc/ssl/ and make sure there's a link to it from '''/etc/ssl/wildcard.mageia.org.pem'''. Finally, copy the new key file to '''/etc/ssl/wildcard.mageia.org.key''' (making sure it has mode 0700).+== Install ==  +When it's ready, download the new certificate as well as the Intermediate certificate (in case it changed from the last year). Backup the current certificate files by copying them into a directory based on the year they were requested, in case a reversion is needed (if they weren't already copied there last year). Copy the signed cert to neru, sucuk and duvel in '''/etc/ssl/wildcard.mageia.org.crt'''. Store the intermediate certificate in /etc/ssl/ and make sure there's a link to it from '''/etc/ssl/wildcard.mageia.org.pem'''. Finally, copy the new private key file to '''/etc/ssl/wildcard.mageia.org.key''' (making sure it has mode 0700).    −Finally, restart Apache on neru with '''systemctl reload apache'''. Test the new certificate by running '''curl -vI https://blog.mageia.org/''' and look for the new expiration year and for any certificate errors. If it works, do the same on sucuk, using '''curl -vI https://www.mageia.org/''' as the test.+== Test == − +Finally, restart Apache on each of the three servers with '''systemctl reload apache'''. Test the new certificate by running '''curl -vI https://blog.mageia.org/''' as well as '''gitweb.mageia.org''' and '''advisories.mageia.org''' (to check all three servers, although you should check them one at a time as you install the certs) and look for the new expiration year and for any certificate errors. −''TODO: add update instructions for duvel''      Revert the DNS record added previously, remembering to increment the SOA serial (don't use '''git revert'''). Revert the DNS record added previously, remembering to increment the SOA serial (don't use '''git revert'''). Danf

‎Wild card certificate: duvel

← Older revision Revision as of 06:44, 11 February 2025 (One intermediate revision by the same user not shown)Line 32: Line 32:  = Wild card certificate = = Wild card certificate =    −* Regenerate a csr file.+== Create ==  +* Generate a CSR file. This creates a new public certificate that we will ask Gandi to sign.     <pre> <pre> −openssl req -nodes -newkey rsa:2048 -sha256 -keyout /etc/ssl/wildcard.mageia.org.key -out /etc/ssl/wildcard.mageia.org.csr -utf8  +openssl req -nodes -newkey rsa:2048 -sha256 -keyout wildcard.mageia.org.key -out wildcard.mageia.org.csr -utf8    </pre> </pre> −Use FR as country, Paris as city, Mageia.Org as Organization Name, and (most importantly) *.mageia.org as Common Name (although, it's not clear if Gandi actually keeps all that data or replaces it). Then go on [https://admin.gandi.net/?locale=en Gandi website] → SSL Certificates → *.mageia.org and click on ''Renew''.+Use FR as country, Paris as city, Mageia.Org as Organization Name, and (most importantly) *.mageia.org as Common Name (although, it's not clear if Gandi actually keeps all that data or replaces it); leave the other fields blank. Then go on [https://admin.gandi.net/?locale=en Gandi website] → SSL Certificates → *.mageia.org and click on ''Renew''.    −Choose ''Standard'' and ''Full domain'' then click on ''Next''+Choose ''DigiCert'', ''Standard'' and ''Full domain'' then click on ''Next''    −On the window paste the content of the csr file.+In the text box paste the content of the csr file.     Check if we have enough of a credit balance at Gandi to pay for it. If not and expiration is imminent, use a credit card. When the certificate is renewed, choose DNS method for the validation. Check if we have enough of a credit balance at Gandi to pay for it. If not and expiration is imminent, use a credit card. When the certificate is renewed, choose DNS method for the validation.    −Then, go on the certificate, I will provide a DNS record to add in our DNS server.+Then, choose the ''SSL CERTIFICATES'' sidebar, then click on the *.mageia.org certificate. After some minutes/hours, the ''Validation instructions'' section will provide a CNAME record to add to DNS. Add it similar to [https://gitweb.mageia.org/infrastructure/puppet/commit/?id=231e095d4d4dc099589ad27c43e4e9244f78095c this commit]. Wait some minutes/hour (the time it takes for the DNS to get updated). You can follow the process along on the Gandi certificate page.    −Follow this commit:+== Install ==  +When it's ready, download the new certificate as well as the Intermediate certificate (in case it changed from the last year). Backup the current certificate files by copying them into a directory based on the year they were requested, in case a reversion is needed (if they weren't already copied there last year). Copy the signed cert to neru, sucuk and duvel in '''/etc/ssl/wildcard.mageia.org.crt'''. Store the intermediate certificate in /etc/ssl/ and make sure there's a link to it from '''/etc/ssl/wildcard.mageia.org.pem'''. Finally, copy the new private key file to '''/etc/ssl/wildcard.mageia.org.key''' (making sure it has mode 0700).    −https://gitweb.mageia.org/infrastructure/puppet/commit/?id=231e095d4d4dc099589ad27c43e4e9244f78095c+== Test ==  +Finally, restart Apache on each of the three servers with '''systemctl reload apache'''. Test the new certificate by running '''curl -vI https://blog.mageia.org/''' as well as '''gitweb.mageia.org''' and '''advisories.mageia.org''' (to check all three servers, although you should check them one at a time as you install the certs) and look for the new expiration year and for any certificate errors.    −Wait some minutes/hour (the time it takes for the DNS to get updated). You can follow the process along on the Gandi page.+Revert the DNS record added previously, remembering to increment the SOA serial (don't use '''git revert'''). −   −When it's ready, download the new certificate as well as the Intermediate certificate (in case it changed from the last year). Backup the current certificate files by copying them into a directory based on the year they were requested, in case a reversion is needed. Add the main certificate on neru and sucuk in '''/etc/ssl/wildcard.mageia.org.crt'''. Store the intermediate certificate in /etc/ssl/ and make sure there's a link to it from '''/etc/ssl/wildcard.mageia.org.pem'''. Finally, copy the new key file to '''/etc/ssl/wildcard.mageia.org.key''' (making sure it has mode 0700).  −   −Finally, restart Apache on neru with '''systemctl reload apache'''. Test the new certificate by running '''curl -vI https://blog.mageia.org/''' and look for the new expiration year and for any certificate errors. If it works, do the same on sucuk, using '''curl -vI https://www.mageia.org/''' as the test.  −   −Revert the DNS record added previously, remembering to increment the serial (don't use '''git revert''').         [[Category:Sysadmin]] [[Category:Sysadmin]] Danf

To do a good job, we need good tools. Some of our servers are old, no longer powerful enough and have limited disk resources to meet the needs of developers. RPM manufacturing takes a long time and this is detrimental to the efficiency of maintaining and evolving the distribution. In short, the machines are well depreciated.

This is why our infrastructure is first getting a makeover. Better adapted to new technologies, it will allow our developers to work faster and more efficiently.

So where is this new infrastructure?

 We received 5 new servers:

– 2 new nodes for building packages: HPE ProLiant DL 360 Gen10 – 2xXeon 6126 (12C/2.6GHz) –

256GB RAM – 2xSSD 3.8TB HW Raid 1 – 2x10Gb/s NICs

– 2 servers to replace sucuk and duvel: HPE ProLiant DL 380 Gen10 – 2 Xeon 6126 (12C/2.6GHz) –

256GB RAM – 2xSSD 3.8TB HW Raid 1 – 10xHDD 12TB HW Raid 5 – 2x10Gb/s NICs

– 1 server for deployment and backup: HPE ProLiant DL80 Gen9 – 2xXeon  E5-2603v4

(6C/1.7GHz) – 256GB RAM – 6xHDD 6TB (donated, with some renewed parts)

– 1 Arista 7120T switch 20xRJ-45 10Gb/s 4xSFP+ 10Gb/s for interconnecting the machines

One of the ideas is to use the latest server to deploy quickly and as automatically as possible the construction nodes and other machines. The method is ready for x86_64 nodes and is being finalized for ARM nodes. The preparation of the servers takes time because the teams anticipate the future and future developments.

Once the preparation part of our servers is finished, the integration part into the Data Center will remain.

We are therefore taking our time to do things well in order to perpetuate the future and future versions of Mageia.

In the meantime, the future version 10 of Mageia continues to bubble in its cauldron! But we are not ready yet to plan a release date for the moment.

Feel free to come and strengthen our teams.

Para hacer un buen trabajo, necesitamos buenas herramientas. Algunos de nuestros servidores son viejos, ya no son lo bastante potentes y tienen recursos de disco limitados para satisfacer las necesidades de los desarrolladores. Se tarda mucho en producir los RPM, lo que va en detrimento de la eficacia del mantenimiento y la actualización de la distribución. En resumen, las máquinas están bien amortizadas.

Es por eso que nuestra infraestructura está recibiendo un lavado de cara. Más adaptada a las nuevas tecnologías, permitirá a nuestros desarrolladores trabajar de forma más rápida y eficaz. ¿Cuál es el estado de esta nueva infraestructura? Hemos recibido 5 nuevos servidores:

· 2 nuevos nodos de construcción de paquetes: HPE ProLiant DL 360 Gen10 – 2xXeon 6126 (12C/2.6GHz) – 256GB RAM – 2xSSD 3.8TB HW Raid 1 – 2x10Gb/s NICs.

· 2 servidores para reemplazar sucuk y duvel: HPE ProLiant DL 380 Gen10 – 2 Xeon 6126 (12C/2.6GHz) – 256GB RAM – 2xSSD 3.8TB HW Raid 1 – 10xHDD 12TB HW Raid 5 – 2x10Gb/s NICs.

· 1 servidor de despliegue y copia de seguridad: HPE ProLiant DL80 Gen9 – 2xXeon E5-2603v4 (6C/1.7GHz) – 256GB RAM – 6xHDD 6TB (una donación, con algunas partes renovadas)

· 1 switch Arista 7120T 20xRJ-45 10Gb/s 4xSFP+ 10Gb/s para interconectar las máquinas.

El plan es utilizar el último servidor para desplegar los nodos de construcción y el resto de máquinas de forma rápida y lo más automática posible. El método está listo para los nodos x86_64 y se está ultimando para los nodos ARM (servidores remotos). La preparación de los servidores lleva su tiempo, ya que nuestros equipos se anticipan al futuro y a los futuros desarrollos.

Una vez finalizada la preparación de nuestros servidores, el siguiente paso será integrarlos en el Centro de Datos. Por lo tanto, nos estamos tomando nuestro tiempo para hacer las cosas bien y poder asegurar el futuro y las futuras versiones de Mageia. Por el momento, no publicamos una fecha de lanzamiento provisional para Mageia 10.

Mientras tanto, ¡la futura versión 10 de Mageia sigue burbujeando en su caldero!

No dudes en unirte a nuestros equipos.

In Mageia/9/x86_64: Mesa is an OpenGL 4.6 compatible 3D graphics library.

In Mageia/9/aarch64: Mesa is an OpenGL 4.6 compatible 3D graphics library.

In Mageia/9/armv7hl: Mesa is an OpenGL 4.6 compatible 3D graphics library.

In Mageia/9/i586: Mesa is an OpenGL 4.6 compatible 3D graphics library.

In Mageia/cauldron/x86_64: Rachota is a portable application for timetracking different projects. It runs everywhere. It displays time data in diagram form, creates customized reports and invoices or analyses measured data and suggests hints to improve user's time usage. The totally portable yet personal timetracker.

In Mageia/cauldron/i586: Rachota is a portable application for timetracking different projects. It runs everywhere. It displays time data in diagram form, creates customized reports and invoices or analyses measured data and suggests hints to improve user's time usage. The totally portable yet personal timetracker.

In Mageia/cauldron/i586: A program to convert images from PPM format into the control language for the Alps Micro-Dry printers, at various times sold by Citizen, Alps and Okidata. This program drives the Alps Micro-Dry series of printers, including the Citizen Printiva series, Alps MD series, and Oki DP series (but not yet the DP-7000). In the current release, the program drives the standard mode fairly well; the dye sublimation mode very well; and the VPhoto mode reasonably well. It supports all the colours available up to the DP-5000, including the foil colours.

In Mageia/cauldron/x86_64: A program to convert images from PPM format into the control language for the Alps Micro-Dry printers, at various times sold by Citizen, Alps and Okidata. This program drives the Alps Micro-Dry series of printers, including the Citizen Printiva series, Alps MD series, and Oki DP series (but not yet the DP-7000). In the current release, the program drives the standard mode fairly well; the dye sublimation mode very well; and the VPhoto mode reasonably well. It supports all the colours available up to the DP-5000, including the foil colours.

In Mageia/cauldron/x86_64: This tool tries to recover JFIF (JPEG) pictures and MOV movies (using recovermov) from a peripheral. This may be useful if you mistakenly overwrite a partition or if a device such as a digital camera memory card is bogus.

In Mageia/cauldron/i586: This tool tries to recover JFIF (JPEG) pictures and MOV movies (using recovermov) from a peripheral. This may be useful if you mistakenly overwrite a partition or if a device such as a digital camera memory card is bogus.

In Mageia/cauldron/x86_64: Rdfind is a program that finds duplicate files. It is useful for compressing backup directories or just finding duplicate files. It compares files based on their content, NOT on their file names.

In Mageia/cauldron/i586: Rdfind is a program that finds duplicate files. It is useful for compressing backup directories or just finding duplicate files. It compares files based on their content, NOT on their file names.

In Mageia/cauldron/x86_64: Unifont is a Unicode font with a glyph for every visible Unicode Basic Multilingual Plane code point and more, with supporting utilities to modify the font. This package contains tools and glyph descriptions.