Issued:

2012-09-21

Updated:

2013-02-20

RHBA-2012:1302 - cvs bug fix update

Synopsis

cvs bug fix update

Type/Severity

Bug Fix Advisory

Topic

An updated cvs package that fixes two bugs is now available for Red Hat Enterprise Linux 6.

[Update 19 November 2012] The file list of this advisory was updated to move the new cvs-inetd package from the base repository to the optional repository in the Client and HPC Node variants. No changes have been made to the packages themselves.

Description

The Concurrent Versions System (CVS) is a version control system that can record the history of your files. CVS only stores the differences between versions, instead of every version of every file you have ever created. CVS also keeps a log of who, when, and why changes occurred.

• Prior to this update, the C shell (csh) did not set the CVS_RSH environment variable to "ssh" and the remote shell (rsh) was used instead when the users accessed a remote CVS server. As a consequence, the connection was vulnerable to attacks because the remote shell is not encrypted or not necessarily enabled on every remote server. The cvs.csh script now uses valid csh syntax and the CVS_RSH environment variable is properly set at log-in. (BZ#671145)

• Prior to this update, the xinetd package was not a dependency of the cvs package. As a result, the CVS server was not accessible through network. With this update, the cvs-inetd package, which contains the CVS inetd configuration file, ensures that the xinetd package is installed as a dependency and the xinetd daemon is available on the system. (BZ#695719)

All users of cvs are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

Affected Products

Updated Packages

• cvs-1.11.23-15.el6.x86_64.rpm
• cvs-debuginfo-1.11.23-15.el6.s390x.rpm
• cvs-debuginfo-1.11.23-15.el6.i686.rpm
• cvs-1.11.23-15.el6.i686.rpm
• cvs-1.11.23-15.el6.src.rpm
• cvs-inetd-1.11.23-15.el6.noarch.rpm
• cvs-debuginfo-1.11.23-15.el6.x86_64.rpm
• cvs-1.11.23-15.el6.ppc64.rpm
• cvs-1.11.23-15.el6.s390x.rpm
• cvs-debuginfo-1.11.23-15.el6.ppc64.rpm

Fixes

• This content is not included.BZ - 671145
• This content is not included.BZ - 695719

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.