19:21:20 <Sparks> #startmeeting Security Team Meeting - Agenda: https://fedoraproject.org/wiki/Security_Team_meetings 19:21:20 <zodbot> Meeting started Wed Aug 27 19:21:20 2014 UTC. The chair is Sparks. Information about MeetBot at http://wiki.debian.org/MeetBot. 19:21:20 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic. 19:21:23 <Sparks> #meetingname Fedora Security Team 19:21:23 <zodbot> The meeting name has been set to 'fedora_security_team' 19:21:24 <Sparks> #topic Roll Call 19:22:03 * Sparks 19:22:14 * Sparks spies bvincent and jtaylor90 19:22:24 <bvincent> .fas bvincent 19:22:25 <zodbot> bvincent: bvincent 'Brandon Vincent' <Brandon.Vincent@asu.edu> 19:22:40 <jsmith> .hellomynameis jsmith 19:22:41 <zodbot> jsmith: jsmith 'Jared Smith' <jsmith.fedora@gmail.com> 19:24:16 * Sparks apologizes for being tardy 19:24:21 <Sparks> Okay, we'll get started. 19:24:44 <Sparks> #topic Security-Team FAS Group and Editing BZ tickets 19:25:46 <Sparks> Some members were saying that they couldn't edit BZ tickets while others could. A FAS group was created and permissions extended to that group so this should no longer be a problem. 19:26:19 <Sparks> #info All FST members should apply to the security-team group in FAS. 19:26:50 <Sparks> #info Members should use the email address used in FAS for their account in BZ. 19:26:53 <Sparks> Any questions? 19:27:58 <Sparks> #topic Outstanding BZ Tickets 19:28:01 <Sparks> #topic Outstanding BZ Tickets 19:29:19 <Sparks> #info Wednesday's numbers: Critical 2, Important 62, Moderate 398, Low 130, Total 592, Trend +17 19:30:44 <Sparks> #info Current tickets owned: 155 19:30:55 <revskills> sounds great 19:31:14 <Sparks> #info Closed tickets: 33 19:31:23 <Sparks> So, not bad. 19:31:50 <bvincent> OpenStack will be removed from EPEL. That should clear out a lot of stagnant reports. 19:32:08 <Sparks> I know I'm having some difficulties in getting some cases closed. My largest problem is going to be the orphaned packages. We'll see what releng ends up doing with them. 19:32:40 <Sparks> bvincent: Wow, no more OS in EPEL? 19:32:52 <misc> maybe saying "this one has a CVE and is orphaned, so we should fast track the removal" ? 19:32:56 <bvincent> #link https://fedorahosted.org/rel-eng/ticket/5966 19:33:34 <bvincent> Garth wants to redirect users to RDO. 19:33:50 <bvincent> #link http://openstack.redhat.com 19:34:38 <Sparks> misc: Well, we did that but got some bad feedback on libmodplug. 19:35:04 <Sparks> misc: Hopefully someone will actually maintain it. Orphaned packages with vulnerabilities aren't a good thing. 19:35:07 <bvincent> What should we do about issues that the packager has not responded to emails? 19:35:26 <bvincent> The broken encryption issue in Synergy is in the Fedora 19 and EPEL packages. 19:35:34 <Sparks> bvincent: We can start the unresponsive packager protocol. 19:35:53 <bvincent> Sparks: Is their a link to this procedure? 19:36:03 <bvincent> *there 19:36:43 <Sparks> bvincent: There is but I'm not finding it at the moment. 19:37:16 <bvincent> Sparks: If it could be placed on the wiki, that would be great. 19:37:53 <Sparks> #link https://fedoraproject.org/wiki/Policy_for_nonresponsive_package_maintainers 19:38:03 <bvincent> Sparks: Excellent. Thanks! 19:38:11 <revskills> +1 Sparks 19:38:19 <Sparks> bvincent: We can also get a proven packager to assist (like jsmith). 19:38:48 * jsmith is happy to assist 19:39:01 <Sparks> jsmith: Can you fix everything by lunch tomorrow? 19:39:20 <jsmith> Sparks: Nope... but I'm sure I could get around to *something* by then 19:39:52 <Sparks> heh 19:40:15 <Sparks> Anyone have any tickets they'd like to discuss? 19:40:50 <jsmith> Not anything in particular from me -- though it might be interesting to see if there are any critical unassigned bugs that could be assigned 19:41:27 <Sparks> jsmith: I'm working the only two critical bugs (for the same package) 19:41:37 <revskills> I don't have really serious problems, only owncloud with one CVE about admin bypass without details but we ask upstream for details 19:41:41 <revskills> all is going fine for me 19:41:43 <Sparks> jsmith: I've not been getting any information from upstream or down. 19:41:57 <jsmith> Sparks: OK, let me know if I can help in any way... 19:41:59 <revskills> all/everything 19:43:13 <Sparks> jsmith: Know anything about ruby-gems? 19:44:08 <Sparks> jsmith: Specifically rubygems-activesupport 19:44:51 <revskills> Sparks: I think huzaifas is working with glibc 19:45:14 <Sparks> revskills: Yes, he's owning that right now and paying for it too. :) 19:45:14 <revskills> do you have more info about this? because the exploit from Tavis Ormandy was directly for f20 19:45:35 <revskills> ok good to know 19:45:36 <revskills> :) 19:45:51 <Sparks> revskills: Sorry, I don't. 19:47:02 <jsmith> Sparks: No, but I'm willing to learn 19:47:58 <Sparks> #topic Open Floor 19:48:06 <Sparks> Anyone have anything they want to talk? 19:48:20 <jsmith> Sparks: Mind re-posting the links to the outstanding BZ items? 19:48:31 <jsmith> Sparks: For folks who might not already have them bookmarked? 19:48:41 * jsmith has nothing further 19:49:37 <Sparks> jsmith: The links are available on the wiki page. 19:49:45 <Sparks> #link https://fedoraproject.org/wiki/Security_Team 19:50:34 <Sparks> And for those playing at home: 19:50:40 <Sparks> #link https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&classification=Fedora&keywords=SecurityTracking%2C%20&keywords_type=allwords&list_id=2661454&priority=urgent&query_format=advanced 19:50:49 <Sparks> #link https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&classification=Fedora&keywords=SecurityTracking%2C%20&keywords_type=allwords&list_id=2661457&priority=high&query_format=advanced 19:50:59 <Sparks> #link https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&classification=Fedora&keywords=SecurityTracking%2C%20&keywords_type=allwords&list_id=2661461&priority=medium&query_format=advanced 19:51:06 <Sparks> #link https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&classification=Fedora&keywords=SecurityTracking%2C%20&keywords_type=allwords&list_id=2661462&priority=low&query_format=advanced 19:51:55 <Sparks> Those are links for critical, important, moderate, and low vulnerabilities, respectfully. 19:52:53 <Sparks> Okay, anything else? 19:54:29 * jsmith has nothing 19:54:41 <Sparks> Okay, I'm closing the meeting, then. Thanks for everyone coming today. 19:54:48 <Sparks> #endmeeting