RHBA-2013:1555 - Bug Fix Advisory

Topic

Updated cvs packages that fix one bug and add one enhancement are now available
for Red Hat Enterprise Linux 6.

Description

The Concurrent Versions System (CVS) is a version control system that can record
the history of your files. CVS only stores the differences between versions,
instead of every version of every file you have ever created. CVS also keeps a
log of who, when, and why changes occurred.

This update fixes the following bug:

• When a CVS client tried to establish a GSSAPI-authenticated connection to a

DNS load-balanced cluster node, the authentication failed because each node had
a unique host name. With this update, the GSSAPI CVS server has been modified to
search for any Kerberos key that matches the "cvs" service and any host name. As
a result, the CVS server can now authenticate clients using GSSAPI even if the
server's host name does not match the domain name, and thus Kerberos principal
host name part, common for all cluster nodes. CVS server administrators are
advised to deploy two Kerberos principals to each node: a principal matching the
node's host name and a principal matching the cluster's domain name. (BZ#671460)

In addition, this update adds the following enhancement:

• Previously, the CVS server did not pass the client address to the Pluggable

Authentication Modules (PAM) system. As a consequence, it was not possible to
distinguish clients by the network address with the PAM system and the system
was not able to utilize the client address for authentication or authorization
purposes. With this update, the client network address is passed to the PAM
subsystem as a remote host item (PAM_RHOST). Also, the terminal item (PAM_TTY)
is set to a dummy value "cvs" because some PAM modules cannot work with an unset
value. (BZ#684789)

Users of cvs are advised to upgrade to these updated packages, which fix this
bug and add this enhancement.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 671460 - Missing patch to support CVS/GSSAPI with DNS-loadbalanced clusters
• BZ - 684789 - CVS PAM authentication does not support RHOST item

CVEs

(none)

References

(none)