From 4ffdef1ddd35f95e117cf9e39b9fecc88e6bb7ea Mon Sep 17 00:00:00 2001 From: Tony Vroon Date: Mon, 5 Jan 2015 11:12:37 +0000 Subject: [PATCH] Version bump by Ferenc Erki closes bug #525582. Mitigation and bump for cross-site scripting vulnerability by Ferenci Erki for security bug 524682. Package-Manager: portage-2.2.15/cvs/Linux x86_64 Manifest-Sign-Key: 0xB5058F9A --- app-misc/elasticsearch/ChangeLog | 13 ++++++-- app-misc/elasticsearch/Manifest | 14 +++++---- ...2.ebuild => elasticsearch-1.3.2-r2.ebuild} | 30 +++++++++---------- ...2-r1.ebuild => elasticsearch-1.4.0.ebuild} | 5 ++-- .../files/1.3.2-http_cors_disable.patch | 18 +++++++++++ 5 files changed, 55 insertions(+), 25 deletions(-) rename app-misc/elasticsearch/{elasticsearch-1.3.2.ebuild => elasticsearch-1.3.2-r2.ebuild} (73%) rename app-misc/elasticsearch/{elasticsearch-1.3.2-r1.ebuild => elasticsearch-1.4.0.ebuild} (94%) create mode 100644 app-misc/elasticsearch/files/1.3.2-http_cors_disable.patch diff --git a/app-misc/elasticsearch/ChangeLog b/app-misc/elasticsearch/ChangeLog index 6f6abe835008..b3ca9b199bf8 100644 --- a/app-misc/elasticsearch/ChangeLog +++ b/app-misc/elasticsearch/ChangeLog @@ -1,6 +1,15 @@ # ChangeLog for app-misc/elasticsearch -# Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/ChangeLog,v 1.7 2014/10/06 14:36:26 chainsaw Exp $ +# Copyright 1999-2015 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/ChangeLog,v 1.8 2015/01/05 11:12:33 chainsaw Exp $ + +*elasticsearch-1.4.0 (05 Jan 2015) +*elasticsearch-1.3.2-r2 (05 Jan 2015) + + 05 Jan 2015; Tony Vroon -elasticsearch-1.3.2.ebuild, + -elasticsearch-1.3.2-r1.ebuild, +elasticsearch-1.3.2-r2.ebuild, + +elasticsearch-1.4.0.ebuild, +files/1.3.2-http_cors_disable.patch: + Version bump by Ferenc Erki closes bug #525582. Mitigation and bump for + cross-site scripting vulnerability by Ferenci Erki for security bug 524682. *elasticsearch-1.3.2-r1 (06 Oct 2014) diff --git a/app-misc/elasticsearch/Manifest b/app-misc/elasticsearch/Manifest index 5087bd92f321..6f64d2abafc3 100644 --- a/app-misc/elasticsearch/Manifest +++ b/app-misc/elasticsearch/Manifest @@ -1,6 +1,7 @@ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 +AUX 1.3.2-http_cors_disable.patch 784 SHA256 fe3327d8f67e7a045360febad32cc45a6d5f0c0af87d2c01cb3a44b8c064a1b5 SHA512 a636ef08bfc20c973e422baf20bd9e5fc5e741b31f6026572afba3562c024e8b4d6b0eb3bdc10f8f68430064a5bb4aa3ea5e7c1853589979c498e47617407b17 WHIRLPOOL 9cd7e62ba4edaffdc79d7d715840f2f7c01e8fce22983b975bbb01bf005e8f5875023e28d9449053c4ce2cff7b9f5b47568200cdf969a4c8d80175ba0617d677 AUX elasticsearch.conf 428 SHA256 cabfe972ef28b30d152c022e4a0510f6ce940687a452b8dfb21c060a14af7860 SHA512 f61a75394776a9c2cac5b4dcfcaee03531808546a360a04e28d83f9bde5804bb9ffa305d3b49679a3fafdaa8c060ecbf88486ed1cdd4072af10e287e599d834d WHIRLPOOL 5fb0590f1264b3a3c1bba759c426edc72f2e2d1c2198c9d67c81a4c73b90ba123b052e8b8aea21be920a1c795b6222a592d37949ac705e81d3493dad9ce6d5b4 AUX elasticsearch.init 2276 SHA256 bc3941c26bd98f148b757200fad3bdd68776ebf0bdb4844b47a02ef82c2384fa SHA512 5d8cb832420fc2484dcb18f98adbb1359b7129b26485bd557c7ef3260ff38ca6a7064a07f91d4824cc045046b6eedd49f19001bcaf9ff6b409b810d0e723f97c WHIRLPOOL 994c63d4026e0288e42993bb8e7eca62c383c6854e96ca4f2e5f7fa41c8b83f7822f696c9cb2f37c696862fec77cca3ca511c5669a2de9267b168c14401c18bd AUX elasticsearch.init2 2296 SHA256 a2abd2f6423ebc382a130b6264114d2e4b28d1ec705939f6ccc818bb7a86b491 SHA512 2439482409908774e02726f81bcf8c9d80d0c3e00c468e4ae95dbb7ae9035fd27ae47aa08b1a705ba808a5222b95b37189b1e9ab7ec89797b9f90db572b5f89f WHIRLPOOL 37a1866079dbc0ec6624b2da2da2914752d76d02ebb4764d209a716ac90f1b29014be9930ba6b5999f513b6357c9088d24db3c2b14c763e792dc1c63d2f9fe34 @@ -8,14 +9,15 @@ AUX elasticsearch.init3 2319 SHA256 cb00de8eb5d6f3ddfe48fed1fe20b527900ad79984e2 AUX elasticsearch.service 274 SHA256 d8581135cb5f6b73245e571f0cd3cfa85c90d96474304214324958b9ee952f7e SHA512 14c0696ab1244e4afde34c0f6aaececbb5a80a75dc9ad23841adefde815c8c9a604858902bd87609d8191dfca7c4eb24f1ad2d041d50d22a789296bf43366a76 WHIRLPOOL 8df4eb48efac8353c21685bc17bd30ce8835f9f5f91f19acd3f69a42a780c69fc118f74d003429e1da9558ffad1a1e649c57521ba8219fcb262a2ffdb2e24e9c AUX elasticsearch.service2 279 SHA256 2a827cfa6331652e5a34bb975da52fec6d12ce0a80eacf810f62e22c5272349b SHA512 17994b7a5b0ef883034765d2b0e5c29daccb1e122b956f598d0c2b24085a0e66450fa143e3c656d75bf149a53ca497bc8c747b62ba47743aad17ae1a446d6d7d WHIRLPOOL 0c97253da7f75586c135568036f149f2465a1d73f5cb6e67b45a36832c2f54b61b0bcfd60db122c7e1ea6e7595e379dfe49a7e7bbad596840da6158a7d56dc46 DIST elasticsearch-1.3.2.tar.gz 27949096 SHA256 7525d0a4db4f7eb791a1f8da97b081a5d8b44a2b232d8324877177bdee992ea4 SHA512 4a67531cf9927db466f70b4c572c472913533352de586f7e2c5f84ec9c7337002a0de0ee2bdb809e99b954bb8bd7d207baf723f1b53b2949702f838c85d6380a WHIRLPOOL 3b3edfefa6e49b2271ed107ecc8d2a84ab3db6834f85eb90c33fc8f9dfff4a815cbd2f3d7af2e6f6a9edfd2186508f6308bdee3846405cebf4ab89e8d13f0ffd -EBUILD elasticsearch-1.3.2-r1.ebuild 2173 SHA256 83b59820c8feee36243f0e4cee25047c643688d0323a8d138526cd416f0d3fd4 SHA512 1352fb3877e1e9eb229a98f8dd82fb8d1a4970e46b957e0322b3911b180bff667dc0f0419e2fbd92d1f62bda5a68deb4538d360de7e1ead81b363f44020e4d5c WHIRLPOOL c9ba4efb97b721147f0c107745b7b2b4c3c49fd3a3af8f9aa8fa93974147b0b4005b6ec57ff49067f4a9df9fc9d2c233a681bc58dec7de5dc30e01cc56429d0c -EBUILD elasticsearch-1.3.2.ebuild 2235 SHA256 b8956c61c89178db91d61d8c9a166c3058dcf3f3be50250941009bf1babe3b3f SHA512 567fbcbdf2669ef33b42c29b1774265573b855205d383f99acd47fa7926b91d93521d08c73acf21e721128e1ab1fa20a170fed53c3bd33504615c3a71ff181f7 WHIRLPOOL 0c19433233ce1bb45b94b57a6dbba9a4e99970cbfe329931e8ca06f680d2240654c16f1a274c2a00112de70aa1bc2fea31391fafdde2ea6a822b42a91a684728 -MISC ChangeLog 2125 SHA256 6019125a19c0d37338d4da4c442fbe6cfaa95a05de49f4380c260026272b8e6b SHA512 7baf8a1b2a6052a64d54c6cb91f5df431346d8cfcf90298393acf604b7be5ed10c97878687ce2b5d10d680ae63dcd0dd53acba6066000c742133b95e58467f0a WHIRLPOOL c69e8c0d5b47d6f40b8a6c3381d756ab0a45c16ce3883b649912b5366adc239dcfb7fb3b9e4fd22d61f586cff3455edc7611267ca7d73b97fe27f33d85bd2eab +DIST elasticsearch-1.4.0.tar.gz 27730896 SHA256 b317966befa50c22595477f9bad8ce67932e4d33e08ee8fb1c6e9690afa5064a SHA512 763307f9dc65c408190b1620907573c949755fc2fb3652c8de1068a566f567fb56ace4058762d1243c64391ac25f495ccf92ebfad0af470a83d3154d3ccaec8d WHIRLPOOL 13e596fba51d5b7b5ec2950534d6655238cee56b414e4265eb463ce0de287b9155ac7c7112c9f4222b6e11589f2606f35779df9b40de13032c4c6ee2d43ed85b +EBUILD elasticsearch-1.3.2-r2.ebuild 2250 SHA256 927dfdb53ad925abd252ae540920b2a5b5cd651e3c5523a773466756624cbd60 SHA512 cf6ad8da8d9e085d7c4ad810c34e1933f35fe6339b13dd04f0b905392668995f6d5977e20cdf886f1bab9b07f82d36c419804ae3223f035ecb700a8a7d16d87f WHIRLPOOL b6da7e2cddc723c06354625e5a54cdc6908e16352e676554f36ac076854609729d561f83737ed98c2fb002495a97c3896f998f7acec9c86d7255627abeb5ffa0 +EBUILD elasticsearch-1.4.0.ebuild 2194 SHA256 0b5df04b1b75198283321070d2f48ecd22a56481e9e66c17e122e744428de0ee SHA512 fa1ae4718fa38978c2d5970528fceae78d2d37c12a4b922e9dffd9d55deb718f84f44d7379b7a57af478bcb1db1a2e8968fc5da3253136eabcf0419b281c6860 WHIRLPOOL a4d93829f40fd82d4ed5e03574a2c4be3d860da152fa291c2695213887c6b0ac2122e4b0aaa74171549a74195089aead02a58c1941996235fd7b7a098e208819 +MISC ChangeLog 2564 SHA256 09bdb33224c9b1d7430315bf35449d1c8ba548740f06b81d3c8b62bbe3419eea SHA512 e6ee91e4eb8c9bb9114d723375e3f6b77051aa32a015a7629e762a5ac29c6ce73769046ef5f208e344cb35a46a38ff56ba41ae27e4657f3ba92d0f9997347ec3 WHIRLPOOL 1ae20e7cbbcc0749ebacfb293a3b0f2b0ee5fa2852b61e09122d0c3dd196b62f4aaba247902027a0bd23df454490d0e3f02cfe5305a35d04e84453631fac7c3b MISC metadata.xml 237 SHA256 88d9092fd208599a8b524cca9633d9330223e45c34a44e54b2de05edb4738ac7 SHA512 11773ab2b5adaa81f3c8f73413d2f257ea1d1624df689154ee2697412ff14ea8f9851b805c4a474b486abb0a066cfc929f91eb852a208b9536885d467df36af1 WHIRLPOOL 324b778d3103d615af41fd6d1d978beeeeb08f4823a3c81fd453464b4df2ed59b56a481ddd65b4eb740dc75b4dc69133e761199abe6d27333b1fce97d5b5a1be -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 -iEYEAREIAAYFAlQyqOsACgkQp5vW4rUFj5p9nACfThkZZIgkRYPl8fKyQV9M52Qk -dJIAnii2d87iG+Pc00eumi5quqkPJd9X -=/BGO +iEYEAREIAAYFAlSqcbIACgkQp5vW4rUFj5plJgCeMv7uOKqB+iVo3d2nbzV3hTxO +GtQAoLqflLhHutwjNg8+QUgBZJCW9/pK +=Ak7W -----END PGP SIGNATURE----- diff --git a/app-misc/elasticsearch/elasticsearch-1.3.2.ebuild b/app-misc/elasticsearch/elasticsearch-1.3.2-r2.ebuild similarity index 73% rename from app-misc/elasticsearch/elasticsearch-1.3.2.ebuild rename to app-misc/elasticsearch/elasticsearch-1.3.2-r2.ebuild index 7da71a2f76f6..9dbce79a82da 100644 --- a/app-misc/elasticsearch/elasticsearch-1.3.2.ebuild +++ b/app-misc/elasticsearch/elasticsearch-1.3.2-r2.ebuild @@ -1,6 +1,6 @@ -# Copyright 1999-2014 Gentoo Foundation +# Copyright 1999-2015 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/elasticsearch-1.3.2.ebuild,v 1.2 2014/09/18 10:36:19 chainsaw Exp $ +# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/elasticsearch-1.3.2-r2.ebuild,v 1.1 2015/01/05 11:12:33 chainsaw Exp $ EAPI=5 @@ -29,11 +29,6 @@ src_prepare() { rm lib/sigar/libsigar-ia64-linux.so rm LICENSE.txt - mv bin/${MY_PN}.in.sh bin/${MY_PN}.in.sh.sample - for file in config/* ; do - mv ${file} ${file}.sample - done - use amd64 && { rm lib/sigar/libsigar-x86-linux.so } @@ -41,14 +36,18 @@ src_prepare() { use x86 && { rm lib/sigar/libsigar-amd64-linux.so } + + # Security bug #524682 + epatch "${FILESDIR}/${PV}-http_cors_disable.patch" } src_install() { dodir /etc/${MY_PN} - insinto /etc/${MY_PN} - doins bin/${MY_PN}.in.sh.sample + + insinto /usr/share/doc/${P}/examples + doins bin/${MY_PN}.in.sh doins config/* - rm bin/${MY_PN}.in.sh.sample + rm bin/${MY_PN}.in.sh rm -rf config insinto /usr/share/${MY_PN} @@ -57,7 +56,7 @@ src_install() { keepdir /var/{lib,log}/${MY_PN} - local rcscript=elasticsearch.init2 + local rcscript=elasticsearch.init3 local eshome="/usr/share/${MY_PN}" local jarfile="${MY_PN}-${PV}.jar" local esclasspath="${eshome}/lib/${jarfile}:${eshome}/lib/*:${eshome}/lib/sigar/*" @@ -70,16 +69,17 @@ src_install() { newinitd "${T}/${rcscript}" "${MY_PN}" newconfd "${FILESDIR}/${MY_PN}.conf" "${MY_PN}" - systemd_dounit "${FILESDIR}"/${PN}.service + systemd_newunit "${FILESDIR}"/${PN}.service2 "${PN}.service" } pkg_postinst() { elog elog "You may create multiple instances of ${MY_PN} by" - elog "symlinking the init script ln -sf /etc/init.d/${MY_PN} /etc/init.d/${MY_PN}.instance" + elog "symlinking the init script:" + elog "ln -sf /etc/init.d/${MY_PN} /etc/init.d/${MY_PN}.instance" elog - elog "Each of the *.sample files in /etc/${MY_PN} should be copied" - elog "to the proper configuration directory:" + elog "Each of the example files in /usr/share/doc/${P}/examples" + elog "should be extracted to the proper configuration directory:" elog "/etc/${MY_PN} (for standard init)" elog "/etc/${MY_PN}/instance (for symlinked init)" elog diff --git a/app-misc/elasticsearch/elasticsearch-1.3.2-r1.ebuild b/app-misc/elasticsearch/elasticsearch-1.4.0.ebuild similarity index 94% rename from app-misc/elasticsearch/elasticsearch-1.3.2-r1.ebuild rename to app-misc/elasticsearch/elasticsearch-1.4.0.ebuild index 9d6609ec0830..7462dbf3efc1 100644 --- a/app-misc/elasticsearch/elasticsearch-1.3.2-r1.ebuild +++ b/app-misc/elasticsearch/elasticsearch-1.4.0.ebuild @@ -1,6 +1,6 @@ -# Copyright 1999-2014 Gentoo Foundation +# Copyright 1999-2015 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/elasticsearch-1.3.2-r1.ebuild,v 1.1 2014/10/06 14:36:26 chainsaw Exp $ +# $Header: /var/cvsroot/gentoo-x86/app-misc/elasticsearch/elasticsearch-1.4.0.ebuild,v 1.1 2015/01/05 11:12:33 chainsaw Exp $ EAPI=5 @@ -26,6 +26,7 @@ pkg_setup() { src_prepare() { rm -rf lib/sigar/*{solaris,winnt,freebsd,macosx}* + rm -rf bin/*.{bat,exe} rm lib/sigar/libsigar-ia64-linux.so rm LICENSE.txt diff --git a/app-misc/elasticsearch/files/1.3.2-http_cors_disable.patch b/app-misc/elasticsearch/files/1.3.2-http_cors_disable.patch new file mode 100644 index 000000000000..41f58725e321 --- /dev/null +++ b/app-misc/elasticsearch/files/1.3.2-http_cors_disable.patch @@ -0,0 +1,18 @@ +diff -urN config/elasticsearch.yml config_new/elasticsearch.yml +--- config/elasticsearch.yml 2014-08-13 16:27:06.000000000 +0200 ++++ config_new/elasticsearch.yml 2014-11-12 20:39:53.501990184 +0100 +@@ -383,3 +383,14 @@ + # it unless you need it is recommended (it is disabled by default). + # + #http.jsonp.enable: true ++ ++# Patched by Gentoo due to CVE-2014-6439, for details please see ++# https://bugs.gentoo.org/show_bug.cgi?id=524682 ++# ++# Enable or disable cross-origin resource sharing, i.e. whether a browser ++# on another origin can do requests to Elasticsearch (defaults to true). ++# ++http.cors.enabled: false ++ ++# For further http.cors.* settings, please see Elasticsearch documentation at ++# http://www.elasticsearch.org/guide/en/elasticsearch/reference/1.3/modules-http.html -- 2.26.2