LWN.net's Journal
[Most Recent Entries]
[Calendar View]
Tuesday, January 15th, 2019
| Time |
Event |
| 3:35p |
An ancient OpenSSH vulnerability
An advisory from Harry Sintonen describes several vulnerabilities in the
scp clients shipped with OpenSSH, PuTTY, and others. "Many
scp clients fail to verify if the objects returned by the scp server match
those it asked for. This issue dates back to 1983 and rcp, on which scp is
based. A separate flaw in the client allows the target directory attributes
to be changed arbitrarily. Finally, two vulnerabilities in clients may
allow server to spoof the client output." The outcome is that a
hostile (or compromised) server can overwrite arbitrary files on the client
side. There do not yet appear to be patches available to address these
problems. | | 4:17p |
Security updates for Tuesday
Security updates have been issued by Arch Linux (irssi and systemd), CentOS (systemd), Debian (xen and zeromq3), Fedora (gnutls, kernel, kernel-headers, kernel-tools, and nbdkit), Oracle (libvncserver and systemd), Red Hat (libvncserver), and Ubuntu (haproxy, libarchive, and php-pear). | | 5:23p |
[$] Fedora, UUIDs, and user tracking
"User tracking" is generally contentious in free-software communities—even
if the "tracking" is not really intended to do so. It is often
distributions that have the most interest in counting their users, but
Linux users tend to be more privacy conscious than users of more mainstream
desktop operating systems. The Fedora project recently discussed how to
count its users and ways to preserve their privacy while doing so.
| | 11:07p |
Google Summer of Code mentor projects sought It is that time of year again: Google is looking
for mentor projects for the 2019 Summer of Code. " GSoC is a
global program that draws university student developers from around the
world to contribute to open source. Each student spends three months
working on a coding project, with the support of volunteer mentors, for
participating open source organizations from late May to August. Last year
1,264 students worked with 206 open source organizations." The application deadline is February 6. | | 11:09p |
[$] Ringing in a new asynchronous I/O API While the kernel has had support for asynchronous
I/O (AIO) since the 2.5 development cycle, it has also had people complaining about AIO for about that long. The current interface is seen as difficult to use and inefficient; additionally, some types of I/O are better supported than others. That situation may be about to change with the introduction of a proposed
new interface from Jens Axboe called "io_uring". As might be expected from the name, io_uring introduces just what the kernel needed more than anything else: yet another ring buffer. |
|