4 ms·

RedHat has a fix for 6 and 7 now: https://rhn.redhat.com/errata/RHSA-2015-0092.html https://rhn.redhat.com/errata/RHSA-2015-0092.html

McGlockenshire 12y ago
Does anyone have any insight into when we'll see CentOS packages start hitting the mirrors?
- deleted 12y ago
  [deleted]
  - kokey 12y ago
    That release seems to be dated 7 January 2015.
  - hackersword 12y ago
    This is for https://rhn.redhat.com/errata/RHSA-2015-0016.html https://rhn.redhat.com/errata/RHSA-2015-0016.html This was related to iconv() and UTF8. This is NOT the fix for this CVE.
- darkr 12y ago
  Apparently packages are built but currently awaiting signing + release. Hopefully within an hour or two they should hit the mirrors.
- deleted 12y ago
  [deleted]
- Thaxll 12y ago
  It should be there once it's done: http://mirror.centos.org/centos/6.6/updates/x86_64/Packages/ http://mirror.centos.org/centos/6.6/updates/x86_64/Packages/
- systemz 12y ago
  Packages are ready, but if your mirror don't have them, use manual way: http://systemz.pl/post/fast-ghost-fix-for-cve-2015-0235/ http://systemz.pl/post/fast-ghost-fix-for-cve-2015-0235/ It's for CentOS 6
- nilic 12y ago
  They are now available, on CentOS 6.4 yum update glibc installs glibc-2.12-1.149.el6_6.5 changelog: * Mon Jan 19 2015 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.149.5 - Fix parsing of numeric hosts in gethostbyname_r (CVE-2015-0235, #1183533). Qualys GHOST program returns "not vulnerable" after the upgrade.
  - cpncrunch 12y ago
    I just updated this on a CentOS 6 box, and it broke the server. After I rebooted, it never came online. Luckily it was a backup server, so it's not critical. Right now I'm just waiting for the customer to contact iweb to figure out what went wrong. This is a vanilla server with just some of my software installed (which couldn't possibly have prevented the server from rebooting). Obviously there is some dependency that they forgot to add, so I would hold off on updating anything unless you don't really care if the server is offline for a while.
    - cpncrunch 12y ago
      The problem was the iweb smart layer - they just needed to recreate the smart layer.

McGlockenshire 12y ago

Does anyone have any insight into when we'll see CentOS packages start hitting the mirrors?

deleted 12y ago
[deleted]
- kokey 12y ago
  That release seems to be dated 7 January 2015.
- hackersword 12y ago
  This is for https://rhn.redhat.com/errata/RHSA-2015-0016.html https://rhn.redhat.com/errata/RHSA-2015-0016.html This was related to iconv() and UTF8. This is NOT the fix for this CVE.
darkr 12y ago
Apparently packages are built but currently awaiting signing + release. Hopefully within an hour or two they should hit the mirrors.
deleted 12y ago
[deleted]
Thaxll 12y ago
It should be there once it's done: http://mirror.centos.org/centos/6.6/updates/x86_64/Packages/ http://mirror.centos.org/centos/6.6/updates/x86_64/Packages/
systemz 12y ago
Packages are ready, but if your mirror don't have them, use manual way: http://systemz.pl/post/fast-ghost-fix-for-cve-2015-0235/ http://systemz.pl/post/fast-ghost-fix-for-cve-2015-0235/ It's for CentOS 6
nilic 12y ago
They are now available, on CentOS 6.4 yum update glibc installs glibc-2.12-1.149.el6_6.5 changelog: * Mon Jan 19 2015 Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.149.5 - Fix parsing of numeric hosts in gethostbyname_r (CVE-2015-0235, #1183533). Qualys GHOST program returns "not vulnerable" after the upgrade.
- cpncrunch 12y ago
  I just updated this on a CentOS 6 box, and it broke the server. After I rebooted, it never came online. Luckily it was a backup server, so it's not critical. Right now I'm just waiting for the customer to contact iweb to figure out what went wrong. This is a vanilla server with just some of my software installed (which couldn't possibly have prevented the server from rebooting). Obviously there is some dependency that they forgot to add, so I would hold off on updating anything unless you don't really care if the server is offline for a while.
  - cpncrunch 12y ago
    The problem was the iweb smart layer - they just needed to recreate the smart layer.