RHBA-2012:1302 - Bug Fix Advisory

Topic

An updated cvs package that fixes two bugs is now available for Red Hat
Enterprise Linux 6.

[Update 19 November 2012]
The file list of this advisory was updated to move the new cvs-inetd package
from the base repository to the optional repository in the Client and HPC Node
variants. No changes have been made to the packages themselves.

Description

The Concurrent Versions System (CVS) is a version control system that can record
the history of your files. CVS only stores the differences between versions,
instead of every version of every file you have ever created. CVS also keeps a
log of who, when, and why changes occurred.

• Prior to this update, the C shell (csh) did not set the CVS_RSH environment

variable to "ssh" and the remote shell (rsh) was used instead when the users
accessed a remote CVS server. As a consequence, the connection was vulnerable to
attacks because the remote shell is not encrypted or not necessarily enabled on
every remote server. The cvs.csh script now uses valid csh syntax and the
CVS_RSH environment variable is properly set at log-in. (BZ#671145)

• Prior to this update, the xinetd package was not a dependency of the cvs

package. As a result, the CVS server was not accessible through network. With
this update, the cvs-inetd package, which contains the CVS inetd configuration
file, ensures that the xinetd package is installed as a dependency and the
xinetd daemon is available on the system. (BZ#695719)

All users of cvs are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 671145 - /etc/profile.d/cvs.csh uses non-tcsh syntax
• BZ - 695719 - services that depend on /etc/xinetd.d/ scripts do not list xinetd as a dependency

CVEs

(none)

References

(none)